[pkgsrc/trunk]: pkgsrc/security/volatility The Volatility Framework is a comp...

[pettai <pettai%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/d9c5f16f11bd
branches:  trunk
changeset: 652527:d9c5f16f11bd
user:      pettai <pettai%pkgsrc.org@localhost>
date:      Wed Jun 03 22:21:41 2015 +0000

description:
The Volatility Framework is a completely open collection of tools,
implemented in Python under the GNU General Public License, for the
extraction of digital artifacts from volatile memory (RAM) samples.
The extraction techniques are performed completely independent of the
system being investigated but offer visibilty into the runtime state
of the system. The framework is intended to introduce people to the
techniques and complexities associated with extracting digital artifacts
from volatile memory samples and provide a platform for further work into
this exciting area of research.

diffstat:

 security/volatility/DESCR    |     9 +
 security/volatility/Makefile |    21 +
 security/volatility/PLIST    |  1047 ++++++++++++++++++++++++++++++++++++++++++
 security/volatility/distinfo |     5 +
 4 files changed, 1082 insertions(+), 0 deletions(-)

diffs (truncated from 1098 to 300 lines):

diff -r 7b602552a614 -r d9c5f16f11bd security/volatility/DESCR
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/security/volatility/DESCR Wed Jun 03 22:21:41 2015 +0000
@@ -0,0 +1,9 @@
+The Volatility Framework is a completely open collection of tools,
+implemented in Python under the GNU General Public License, for the
+extraction of digital artifacts from volatile memory (RAM) samples.
+The extraction techniques are performed completely independent of the
+system being investigated but offer visibilty into the runtime state
+of the system. The framework is intended to introduce people to the
+techniques and complexities associated with extracting digital artifacts
+from volatile memory samples and provide a platform for further work into
+this exciting area of research.
diff -r 7b602552a614 -r d9c5f16f11bd security/volatility/Makefile
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/security/volatility/Makefile      Wed Jun 03 22:21:41 2015 +0000
@@ -0,0 +1,21 @@
+# $NetBSD: Makefile,v 1.1 2015/06/03 22:21:41 pettai Exp $
+
+DISTNAME=      volatility-2.4
+CATEGORIES=    security
+MASTER_SITES=  http://downloads.volatilityfoundation.org/releases/2.4/
+
+MAINTAINER=    pettai%NetBSD.org@localhost
+HOMEPAGE=      http://volatilityfoundation.org/
+COMMENT=       Volatility, Art of Memory Forensics
+LICENSE=       gnu-gpl-v2
+
+DEPENDS+=      ${PYPKGPREFIX}-distorm3-[0-9]*:../../devel/py-distorm3
+
+PYDISTUTILSPKG= yes
+REPLACE_PYTHON= tools/vtype_diff.py
+
+PYTHON_VERSIONS_INCOMPATIBLE=  33 34
+
+.include "../../lang/python/extension.mk"
+.include "../../lang/python/application.mk"
+.include "../../mk/bsd.pkg.mk"
diff -r 7b602552a614 -r d9c5f16f11bd security/volatility/PLIST
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/security/volatility/PLIST Wed Jun 03 22:21:41 2015 +0000
@@ -0,0 +1,1047 @@
+@comment $NetBSD: PLIST,v 1.1 2015/06/03 22:21:41 pettai Exp $
+bin/vol.py
+contrib/plugins/aspaces/__init__.py
+contrib/plugins/aspaces/ewf.py
+contrib/plugins/disablewarnings.py
+contrib/plugins/enumfunc.py
+contrib/plugins/example.py
+contrib/plugins/pagecheck.py
+contrib/plugins/psdispscan.py
+contrib/plugins/scanprof.py
+${PYSITELIB}/${PKGNAME}-py2.7.egg-info/PKG-INFO
+${PYSITELIB}/${PKGNAME}-py2.7.egg-info/SOURCES.txt
+${PYSITELIB}/${PKGNAME}-py2.7.egg-info/dependency_links.txt
+${PYSITELIB}/${PKGNAME}-py2.7.egg-info/top_level.txt
+${PYSITELIB}/volatility/__init__.py
+${PYSITELIB}/volatility/__init__.pyc
+${PYSITELIB}/volatility/__init__.pyo
+${PYSITELIB}/volatility/addrspace.py
+${PYSITELIB}/volatility/addrspace.pyc
+${PYSITELIB}/volatility/addrspace.pyo
+${PYSITELIB}/volatility/cache.py
+${PYSITELIB}/volatility/cache.pyc
+${PYSITELIB}/volatility/cache.pyo
+${PYSITELIB}/volatility/commands.py
+${PYSITELIB}/volatility/commands.pyc
+${PYSITELIB}/volatility/commands.pyo
+${PYSITELIB}/volatility/conf.py
+${PYSITELIB}/volatility/conf.pyc
+${PYSITELIB}/volatility/conf.pyo
+${PYSITELIB}/volatility/constants.py
+${PYSITELIB}/volatility/constants.pyc
+${PYSITELIB}/volatility/constants.pyo
+${PYSITELIB}/volatility/debug.py
+${PYSITELIB}/volatility/debug.pyc
+${PYSITELIB}/volatility/debug.pyo
+${PYSITELIB}/volatility/dwarf.py
+${PYSITELIB}/volatility/dwarf.pyc
+${PYSITELIB}/volatility/dwarf.pyo
+${PYSITELIB}/volatility/exceptions.py
+${PYSITELIB}/volatility/exceptions.pyc
+${PYSITELIB}/volatility/exceptions.pyo
+${PYSITELIB}/volatility/fmtspec.py
+${PYSITELIB}/volatility/fmtspec.pyc
+${PYSITELIB}/volatility/fmtspec.pyo
+${PYSITELIB}/volatility/obj.py
+${PYSITELIB}/volatility/obj.pyc
+${PYSITELIB}/volatility/obj.pyo
+${PYSITELIB}/volatility/plugins/__init__.py
+${PYSITELIB}/volatility/plugins/__init__.pyc
+${PYSITELIB}/volatility/plugins/__init__.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/__init__.py
+${PYSITELIB}/volatility/plugins/addrspaces/__init__.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/__init__.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/amd64.py
+${PYSITELIB}/volatility/plugins/addrspaces/amd64.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/amd64.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/arm.py
+${PYSITELIB}/volatility/plugins/addrspaces/arm.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/arm.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/crash.py
+${PYSITELIB}/volatility/plugins/addrspaces/crash.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/crash.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/crashbmp.py
+${PYSITELIB}/volatility/plugins/addrspaces/crashbmp.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/crashbmp.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/elfcoredump.py
+${PYSITELIB}/volatility/plugins/addrspaces/elfcoredump.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/elfcoredump.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/hibernate.py
+${PYSITELIB}/volatility/plugins/addrspaces/hibernate.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/hibernate.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/hpak.py
+${PYSITELIB}/volatility/plugins/addrspaces/hpak.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/hpak.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/ieee1394.py
+${PYSITELIB}/volatility/plugins/addrspaces/ieee1394.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/ieee1394.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/intel.py
+${PYSITELIB}/volatility/plugins/addrspaces/intel.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/intel.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/lime.py
+${PYSITELIB}/volatility/plugins/addrspaces/lime.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/lime.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/macho.py
+${PYSITELIB}/volatility/plugins/addrspaces/macho.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/macho.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/osxpmemelf.py
+${PYSITELIB}/volatility/plugins/addrspaces/osxpmemelf.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/osxpmemelf.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/paged.py
+${PYSITELIB}/volatility/plugins/addrspaces/paged.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/paged.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/standard.py
+${PYSITELIB}/volatility/plugins/addrspaces/standard.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/standard.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/vmem.py
+${PYSITELIB}/volatility/plugins/addrspaces/vmem.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/vmem.pyo
+${PYSITELIB}/volatility/plugins/addrspaces/vmware.py
+${PYSITELIB}/volatility/plugins/addrspaces/vmware.pyc
+${PYSITELIB}/volatility/plugins/addrspaces/vmware.pyo
+${PYSITELIB}/volatility/plugins/bigpagepools.py
+${PYSITELIB}/volatility/plugins/bigpagepools.pyc
+${PYSITELIB}/volatility/plugins/bigpagepools.pyo
+${PYSITELIB}/volatility/plugins/bioskbd.py
+${PYSITELIB}/volatility/plugins/bioskbd.pyc
+${PYSITELIB}/volatility/plugins/bioskbd.pyo
+${PYSITELIB}/volatility/plugins/cmdline.py
+${PYSITELIB}/volatility/plugins/cmdline.pyc
+${PYSITELIB}/volatility/plugins/cmdline.pyo
+${PYSITELIB}/volatility/plugins/common.py
+${PYSITELIB}/volatility/plugins/common.pyc
+${PYSITELIB}/volatility/plugins/common.pyo
+${PYSITELIB}/volatility/plugins/connections.py
+${PYSITELIB}/volatility/plugins/connections.pyc
+${PYSITELIB}/volatility/plugins/connections.pyo
+${PYSITELIB}/volatility/plugins/connscan.py
+${PYSITELIB}/volatility/plugins/connscan.pyc
+${PYSITELIB}/volatility/plugins/connscan.pyo
+${PYSITELIB}/volatility/plugins/crashinfo.py
+${PYSITELIB}/volatility/plugins/crashinfo.pyc
+${PYSITELIB}/volatility/plugins/crashinfo.pyo
+${PYSITELIB}/volatility/plugins/dlldump.py
+${PYSITELIB}/volatility/plugins/dlldump.pyc
+${PYSITELIB}/volatility/plugins/dlldump.pyo
+${PYSITELIB}/volatility/plugins/dumpcerts.py
+${PYSITELIB}/volatility/plugins/dumpcerts.pyc
+${PYSITELIB}/volatility/plugins/dumpcerts.pyo
+${PYSITELIB}/volatility/plugins/dumpfiles.py
+${PYSITELIB}/volatility/plugins/dumpfiles.pyc
+${PYSITELIB}/volatility/plugins/dumpfiles.pyo
+${PYSITELIB}/volatility/plugins/envars.py
+${PYSITELIB}/volatility/plugins/envars.pyc
+${PYSITELIB}/volatility/plugins/envars.pyo
+${PYSITELIB}/volatility/plugins/evtlogs.py
+${PYSITELIB}/volatility/plugins/evtlogs.pyc
+${PYSITELIB}/volatility/plugins/evtlogs.pyo
+${PYSITELIB}/volatility/plugins/fileparam.py
+${PYSITELIB}/volatility/plugins/fileparam.pyc
+${PYSITELIB}/volatility/plugins/fileparam.pyo
+${PYSITELIB}/volatility/plugins/filescan.py
+${PYSITELIB}/volatility/plugins/filescan.pyc
+${PYSITELIB}/volatility/plugins/filescan.pyo
+${PYSITELIB}/volatility/plugins/getservicesids.py
+${PYSITELIB}/volatility/plugins/getservicesids.pyc
+${PYSITELIB}/volatility/plugins/getservicesids.pyo
+${PYSITELIB}/volatility/plugins/getsids.py
+${PYSITELIB}/volatility/plugins/getsids.pyc
+${PYSITELIB}/volatility/plugins/getsids.pyo
+${PYSITELIB}/volatility/plugins/gui/__init__.py
+${PYSITELIB}/volatility/plugins/gui/__init__.pyc
+${PYSITELIB}/volatility/plugins/gui/__init__.pyo
+${PYSITELIB}/volatility/plugins/gui/atoms.py
+${PYSITELIB}/volatility/plugins/gui/atoms.pyc
+${PYSITELIB}/volatility/plugins/gui/atoms.pyo
+${PYSITELIB}/volatility/plugins/gui/clipboard.py
+${PYSITELIB}/volatility/plugins/gui/clipboard.pyc
+${PYSITELIB}/volatility/plugins/gui/clipboard.pyo
+${PYSITELIB}/volatility/plugins/gui/constants.py
+${PYSITELIB}/volatility/plugins/gui/constants.pyc
+${PYSITELIB}/volatility/plugins/gui/constants.pyo
+${PYSITELIB}/volatility/plugins/gui/desktops.py
+${PYSITELIB}/volatility/plugins/gui/desktops.pyc
+${PYSITELIB}/volatility/plugins/gui/desktops.pyo
+${PYSITELIB}/volatility/plugins/gui/eventhooks.py
+${PYSITELIB}/volatility/plugins/gui/eventhooks.pyc
+${PYSITELIB}/volatility/plugins/gui/eventhooks.pyo
+${PYSITELIB}/volatility/plugins/gui/gahti.py
+${PYSITELIB}/volatility/plugins/gui/gahti.pyc
+${PYSITELIB}/volatility/plugins/gui/gahti.pyo
+${PYSITELIB}/volatility/plugins/gui/gditimers.py
+${PYSITELIB}/volatility/plugins/gui/gditimers.pyc
+${PYSITELIB}/volatility/plugins/gui/gditimers.pyo
+${PYSITELIB}/volatility/plugins/gui/messagehooks.py
+${PYSITELIB}/volatility/plugins/gui/messagehooks.pyc
+${PYSITELIB}/volatility/plugins/gui/messagehooks.pyo
+${PYSITELIB}/volatility/plugins/gui/screenshot.py
+${PYSITELIB}/volatility/plugins/gui/screenshot.pyc
+${PYSITELIB}/volatility/plugins/gui/screenshot.pyo
+${PYSITELIB}/volatility/plugins/gui/sessions.py
+${PYSITELIB}/volatility/plugins/gui/sessions.pyc
+${PYSITELIB}/volatility/plugins/gui/sessions.pyo
+${PYSITELIB}/volatility/plugins/gui/userhandles.py
+${PYSITELIB}/volatility/plugins/gui/userhandles.pyc
+${PYSITELIB}/volatility/plugins/gui/userhandles.pyo
+${PYSITELIB}/volatility/plugins/gui/vtypes/__init__.py
+${PYSITELIB}/volatility/plugins/gui/vtypes/__init__.pyc
+${PYSITELIB}/volatility/plugins/gui/vtypes/__init__.pyo
+${PYSITELIB}/volatility/plugins/gui/vtypes/vista.py
+${PYSITELIB}/volatility/plugins/gui/vtypes/vista.pyc
+${PYSITELIB}/volatility/plugins/gui/vtypes/vista.pyo
+${PYSITELIB}/volatility/plugins/gui/vtypes/win2003.py
+${PYSITELIB}/volatility/plugins/gui/vtypes/win2003.pyc
+${PYSITELIB}/volatility/plugins/gui/vtypes/win2003.pyo
+${PYSITELIB}/volatility/plugins/gui/vtypes/win7.py
+${PYSITELIB}/volatility/plugins/gui/vtypes/win7.pyc
+${PYSITELIB}/volatility/plugins/gui/vtypes/win7.pyo
+${PYSITELIB}/volatility/plugins/gui/vtypes/win7_sp0_x64_vtypes_gui.py
+${PYSITELIB}/volatility/plugins/gui/vtypes/win7_sp0_x64_vtypes_gui.pyc
+${PYSITELIB}/volatility/plugins/gui/vtypes/win7_sp0_x64_vtypes_gui.pyo
+${PYSITELIB}/volatility/plugins/gui/vtypes/win7_sp0_x86_vtypes_gui.py
+${PYSITELIB}/volatility/plugins/gui/vtypes/win7_sp0_x86_vtypes_gui.pyc
+${PYSITELIB}/volatility/plugins/gui/vtypes/win7_sp0_x86_vtypes_gui.pyo
+${PYSITELIB}/volatility/plugins/gui/vtypes/win7_sp1_x64_vtypes_gui.py
+${PYSITELIB}/volatility/plugins/gui/vtypes/win7_sp1_x64_vtypes_gui.pyc
+${PYSITELIB}/volatility/plugins/gui/vtypes/win7_sp1_x64_vtypes_gui.pyo
+${PYSITELIB}/volatility/plugins/gui/vtypes/win7_sp1_x86_vtypes_gui.py
+${PYSITELIB}/volatility/plugins/gui/vtypes/win7_sp1_x86_vtypes_gui.pyc
+${PYSITELIB}/volatility/plugins/gui/vtypes/win7_sp1_x86_vtypes_gui.pyo
+${PYSITELIB}/volatility/plugins/gui/vtypes/win8.py
+${PYSITELIB}/volatility/plugins/gui/vtypes/win8.pyc
+${PYSITELIB}/volatility/plugins/gui/vtypes/win8.pyo
+${PYSITELIB}/volatility/plugins/gui/vtypes/xp.py
+${PYSITELIB}/volatility/plugins/gui/vtypes/xp.pyc
+${PYSITELIB}/volatility/plugins/gui/vtypes/xp.pyo
+${PYSITELIB}/volatility/plugins/gui/win32k_core.py
+${PYSITELIB}/volatility/plugins/gui/win32k_core.pyc
+${PYSITELIB}/volatility/plugins/gui/win32k_core.pyo
+${PYSITELIB}/volatility/plugins/gui/windows.py
+${PYSITELIB}/volatility/plugins/gui/windows.pyc
+${PYSITELIB}/volatility/plugins/gui/windows.pyo
+${PYSITELIB}/volatility/plugins/gui/windowstations.py
+${PYSITELIB}/volatility/plugins/gui/windowstations.pyc
+${PYSITELIB}/volatility/plugins/gui/windowstations.pyo
+${PYSITELIB}/volatility/plugins/handles.py
+${PYSITELIB}/volatility/plugins/handles.pyc
+${PYSITELIB}/volatility/plugins/handles.pyo
+${PYSITELIB}/volatility/plugins/heaps.py
+${PYSITELIB}/volatility/plugins/heaps.pyc
+${PYSITELIB}/volatility/plugins/heaps.pyo
+${PYSITELIB}/volatility/plugins/hibinfo.py
+${PYSITELIB}/volatility/plugins/hibinfo.pyc
+${PYSITELIB}/volatility/plugins/hibinfo.pyo
+${PYSITELIB}/volatility/plugins/hpakinfo.py
+${PYSITELIB}/volatility/plugins/hpakinfo.pyc
+${PYSITELIB}/volatility/plugins/hpakinfo.pyo
+${PYSITELIB}/volatility/plugins/iehistory.py
+${PYSITELIB}/volatility/plugins/iehistory.pyc
+${PYSITELIB}/volatility/plugins/iehistory.pyo
+${PYSITELIB}/volatility/plugins/imagecopy.py
+${PYSITELIB}/volatility/plugins/imagecopy.pyc
+${PYSITELIB}/volatility/plugins/imagecopy.pyo
+${PYSITELIB}/volatility/plugins/imageinfo.py
+${PYSITELIB}/volatility/plugins/imageinfo.pyc
+${PYSITELIB}/volatility/plugins/imageinfo.pyo
+${PYSITELIB}/volatility/plugins/joblinks.py
+${PYSITELIB}/volatility/plugins/joblinks.pyc
+${PYSITELIB}/volatility/plugins/joblinks.pyo
+${PYSITELIB}/volatility/plugins/kdbgscan.py
+${PYSITELIB}/volatility/plugins/kdbgscan.pyc
+${PYSITELIB}/volatility/plugins/kdbgscan.pyo
+${PYSITELIB}/volatility/plugins/kpcrscan.py
+${PYSITELIB}/volatility/plugins/kpcrscan.pyc
+${PYSITELIB}/volatility/plugins/kpcrscan.pyo
+${PYSITELIB}/volatility/plugins/linux/__init__.py
+${PYSITELIB}/volatility/plugins/linux/__init__.pyc
+${PYSITELIB}/volatility/plugins/linux/__init__.pyo
+${PYSITELIB}/volatility/plugins/linux/apihooks.py