# packages

pkgId: 3afabd6f38062dff7f4705f68d113391ba34ae36d885f9b2502b41c64f1649f7
name: 2hash
arch: src
version: 0.2
epoch: 0
release: 1.el8
summary: Simultaneously perform an MD5 and SHA1 checksum on files
url: http://trog.qgl.org/20061027/2hash-simultaneous-md5-and-sha1-hashing
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: 2hash-0.2-1.el8.src.rpm
checksum_type: sha256
description:
  2hash simultaneously performs a md5 and a sha1 checksum on file(s).
  If you want two checksums for additionally integrity checking, you previously
  had to run md5sum and sha1sum serially causing the integrity checks to
  take 100% longer than running a single check alone. 2hash runs both hashes
  in parallel, only having to read the file once. It allows you to
  get both hash values with only about an 8% time increase over md5 alone,
  and only about a 2% time increase over sha1 alone. It runs about 90%
  quicker than using both md5 and sha1 one after the other...


pkgId: cc95bf1dcbe4b780800eb3550506f2f472a949bdde4cc0ef079bef288736bf9a
name: DropboxReader
arch: src
version: 1.0
epoch: 0
release: 1.el8
summary: DropboxReader
url: http://cybermarshal.com/index.php/cyber-marshal-utilities/dropbox-reader
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: DropboxReader-1.0-1.el8.src.rpm
checksum_type: sha256
description:
  Dropbox Reader is a suite of command-line tools for parsing configuration and cache files associated with the Dropbox cloud storage software.


pkgId: bcec1207ed1be9c33bfbd44e25fb99ae061b3213eb32a9cf986f53dae2536b2b
name: EVTXtract
arch: src
version: 0.2.3
epoch: 0
release: 1.el8
summary: Recover and reconstruct fragments of EVTX log files from raw binary data
url: https://github.com/williballenthin/EVTXtract
rpm_license: Apache License 2.0
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: EVTXtract-0.2.3-1.el8.src.rpm
checksum_type: sha256
description:
  Python 2 and Python 3.

  EVTX records are XML fragments encoded using a Microsoft-specific binary XML
  representation. Despite the convenient format, it is not easy to recover EVTX event log records
  from a corrupted file or unallocated space. This is because the complete representation of a
  record often depends on other records found nearby. The event log service recognizes similarities
  among records and refactors commonalities into "templates". A template is a fixed structure with
  placeholders that reserve space for variable content. The on-disk event log record structure
  is a reference to a template, and a list of substitutions (the variable content the replaces
  a placeholder in a template). To decode a record into XML, the event log service resolves the
  template and replaces its placeholders with the entries of the substitution array. Therefore,
  template corruption renders many records unrecoverable within the local 64KB "chunk". However,
  the substitution array for the remaining records may still be intact. If so, it may be
  possible to produce XML fragments that match the original records if the damaged template can
  be reconstructed. For many common events, such as process creation or account logon, empirical
  testing demonstrates the relevant templates remain mostly constant. In these cases, recovering
  event log records boils down to identifying appropriate templates found in other EVTX chunks.

  Algorithm

   1. Scan for chunk signatures ("ElfChnk")
      a. check header for sane values (0x80 <= size <= 0x200)
      b. verify checksums (header, data)
   2. Extract records from valid chunks found in (1)
   3. Extract templates from valid chunks found in (1)
   4. Scan for record signatures
      a. check header for sane values
      a. extract timestamp
      c. attempt to parse substitutions
      d. attempt to decode substitutions into EID, other fields
   5. Reconstruct records by reusing old templates with recovered substitutions


pkgId: 0b72e38346b51762ef5d0cfebc8ea32f410b12b86c16b03725f6e87c7d29ea74
name: KStrike
arch: src
version: 20210624
epoch: 0
release: 1.el8
summary: Stand-alone parser for User Access Logging from Server 2012 and newer systems
url: https://github.com/brimorlabs/KStrike
rpm_license: GNU GPL v3 or later and BSD-like with acknowledgment clause
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: KStrike-20210624-1.el8.src.rpm
checksum_type: sha256
description:
  This script will parse data from the User Access Logging files contained on Windows Server 2012
  and newer systems, found under the path "\Windows\System32\Logfiles\SUM" (please visit the KPMG
  blog post at https://advisory.kpmg.us/blog/2021/digital-forensics-incident-response.html for
  more details). For documentation on these files, please visit the official documentation page at
  https://docs.microsoft.com/en-us/windows-server/administration/user-access-logging/manage-user-access-logging.


pkgId: bdf5fe3af2458a482ac8d40f7f028eb3562c1f8d6c5cf3797740e483ed1ae652
name: Volatility
arch: src
version: 2.6.1
epoch: 0
release: 6.el8
summary: Tools for the extraction of digital artifacts from volatile memory (RAM) images
url: https://github.com/volatilityfoundation/volatility
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: Volatility-2.6.1-6.el8.src.rpm
checksum_type: sha256
description:
  The Volatility Framework is a completely open collection of tools,
  implemented in Python under the GNU General Public License, for the
  extraction of digital artifacts from volatile memory (RAM) images. The
  extraction techniques are performed completely independent of the system
  being investigated but offer unprecedented visibilty into the runtime
  state of the system. The framework is intended to introduce people to the
  techniques and complexities associated with extracting digital artifacts
  from volatile memory images and provide a platform for further work into
  this exciting area of research.

  The Volatility Framework demonstrates our committment to and belief
  in the importance of open source digital investigation tools. Volatile
  Systems is committed to the belief that the technical procedures used to
  extract digital evidence should be open to peer analysis and review. We
  also believe this is in the best interest of the digital investigation
  community, as it helps increase the communal knowledge about systems we
  are forced to investigate. Similarly, we do not believe the availability
  of these tools should be restricted and therefore encourage people to
  modify, extend, and make derivative works, as permitted by the GPL.


pkgId: c7a4e64f2c3b52cce8402af281fc49d74169d4f083b9bd0e9f6a97eb2661236a
name: acr
arch: src
version: 1.4
epoch: 0
release: 1.el8
summary: Reverse Engineering Framework
url: http://www.radare.org
rpm_license: LGPL-3.0
rpm_group: Development/Tools/Debuggers
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: acr-1.4-1.el8.src.rpm
checksum_type: sha256
description:
  ACR tries to replace autoconf functionality generating a full-compatible 'configure' script (runtime flags).
  But using shell-script instead of m4. This means that ACR is faster, smaller and easy to use.


pkgId: 9dc631a52d7944a6c2f234a89c9a17274e5b99e3abc798a5f584394d00ed46b3
name: adns
arch: src
version: 1.6.0
epoch: 0
release: 5.el8
summary: Advanced, easy to use, asynchronous-capable DNS client library
url: http://www.chiark.greenend.org.uk/~ian/adns/
rpm_license: GPL+
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: adns-1.6.0-5.el8.src.rpm
checksum_type: sha256
description:
  adns is a resolver library for C (and C++) programs. In contrast with
  the existing interfaces, gethostbyname et al and libresolv, it has the
  following features:
   - It is reasonably easy to use for simple programs which just want to
     translate names to addresses, look up MX records, etc.
   - It can be used in an asynchronous, non-blocking, manner. Many
     queries can be handled simultaneously.
   - Responses are decoded automatically into a natural representation
     for a C program - there is no need to deal with DNS packet formats.
   - Sanity checking (eg, name syntax checking, reverse/forward
     correspondence, CNAME pointing to CNAME) is performed automatically.
   - Time-to-live, CNAME and other similar information is returned in an
     easy-to-use form, without getting in the way.
   - There is no global state in the library; resolver state is an opaque
     data structure which the client creates explicitly. A program can have
     several instances of the resolver.
   - Errors are reported to the application in a way that distinguishes
     the various causes of failure properly.
   - Understands conventional resolv.conf, but this can overridden by
     environment variables.
   - Flexibility. For example, the application can tell adns to: ignore
     environment variables (for setuid programs), disable sanity checks eg
     to return arbitrary data, override or ignore resolv.conf in favour of
     supplied configuration, etc.
   - Believed to be correct ! For example, will correctly back off to TCP
     in case of long replies or queries, or to other nameservers if several
     are available. It has sensible handling of bad responses etc.


pkgId: db6db2775168c47c1081092f25b01d42da58f13e268e3cb070afc5402667bc59
name: afflib
arch: src
version: 3.7.19
epoch: 0
release: 1.el8
summary: Library to support the Advanced Forensic Format
url: https://github.com/sshock/AFFLIBv3
rpm_license: BSD with advertising
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: afflib-3.7.19-1.el8.src.rpm
checksum_type: sha256
description:
  AFF® is an open and extensible file format designed to store disk images and
  associated metadata.
  afflib is library for support of the Advanced Forensic Format (AFF).


pkgId: e051b9329f7cb5f936951f34567bf93ca11c9960d4bcd611072475b8498ab755
name: analysis-pipeline
arch: src
version: 5.11.3
epoch: 0
release: 5.el8
summary: Stream analysis of SiLK records
url: http://tools.netsa.cert.org/analysis-pipeline5/index.html
rpm_license: GPLv2
rpm_vendor: CERT Network Situational Awareness
rpm_group: Applications/System
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: analysis-pipeline-5.11.3-5.el8.src.rpm
checksum_type: sha256
description:
  The SiLK Analysis Pipeline can be added to the SiLK packing process to
  analyze flow records as they are collected by rwflowpack.


pkgId: 4de5984a4840d1a25bae486c71d89c2dcf4d4699e59c0becd242cd26827f6371
name: analyzeMFT
arch: src
version: 3.0.0
epoch: 0
release: 1.el8
summary: analyzeMFT
url: https://github.com/eddsalkield/analyzeMFT3.git
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: analyzeMFT-3.0.0-1.el8.src.rpm
checksum_type: sha256
description:
  analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem
  and present the results as accurately as possible in multiple formats.


pkgId: d08d8fee85810722365f631c2fed04003fbd993830b75c7d4049bb5e8b03bd44
name: antiword
arch: src
version: 0.37
epoch: 0
release: 9.el8
summary: MS Word to ASCII/Postscript converter
url: http://www.winfield.demon.nl/
rpm_license: GPLv2+
rpm_group: Applications/Text
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: antiword-0.37-9.el8.src.rpm
checksum_type: sha256
description:
  Antiword is a free MS-Word reader for Linux, BeOS and RISC OS. It converts
  the documets from Word 6, 7, 97 and 2000 to ASCII and Postscript. Antiword
  tries to keep the layout of the document intact.


pkgId: 0908fa9a1fe3e722c8b93a16a885ee7d7d850c994c5f7dca7e2cd6b598cf24ba
name: apfs-fuse
arch: src
version: 20200928
epoch: 0
release: 1.el8
summary: A read-only FUSE driver for the new Apple File System
url: https://github.com/sgan81/apfs-fuse
rpm_license: GPL
rpm_group: Applications/System
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: apfs-fuse-20200928-1.el8.src.rpm
checksum_type: sha256
description:
  This project is a read-only FUSE driver for the new Apple File System. Since Apple didn't
  yet document the disk format of APFS, this driver should be considered experimental.
  It may not be able to read all files, it may return wrong data, or it may simply crash.
  Use at your own risk. But since it's read-only, at least the data on your apfs drive should be safe.

  Be aware that not all compression methods are supported yet (only the ones I have encountered so far).
  Thus, the driver may return compressed files instead of uncompressed ones.


pkgId: c2bccebca1ed2add051276e830edbbb3f82e12dae2734a0ce942ae3e1b19450e
name: artifacts
arch: src
version: 20220615
epoch: 0
release: 1.el8
summary: artifacts - knowledge base of forensic artifacts
url: https://pypi.python.org/pypi/artifacts
rpm_license: BSD
rpm_vendor: cert.org
rpm_group: Applications
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: artifacts-20220615-1.el8.src.rpm
checksum_type: sha256
description:
  Artifacts is a free, community-sourced, machine-readable knowledge base of forensic artifacts that
  the world can use both as an information source and within other tools.


pkgId: e79efd35d0c3052d024dad5e56a21d1b4e1b8f17c91c7450d0324bd0e403f137
name: autopsy
arch: src
version: 4.19.2
epoch: 0
release: 1.el8
summary: Autopsy Forensic Browser
url: http://www.sleuthkit.org/sleuthkit/
rpm_license: ASL 2.0
rpm_group: System/Base
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: autopsy-4.19.2-1.el8.src.rpm
checksum_type: sha256
description:
  Autopsy is a graphical interface to The Sleuth Kit and other open source digital forensics tools.
  Autopsy 3 was a complete rewrite from Autopsy 2 to make it Java-based.
  Autopsy 4 improves on Autopsy 3 by supporting collaboration on a single case by multiple users.

  Although Autopsy is designed to be cross-platform (Windows, Linux, MacOSX), the current version
  is fully functional and fully tested only on Windows. We have run it on XP, Vista, and Windows
  7 with no problems.

  Autopsy 4 is released under the Apache 2.0 license.
  Some libraries Autopsy uses may have different, but similar, open source licenses.


pkgId: ef5f1b894ca073efd1ec8fe676fbf98e568b62daf444d002e6ca1025ff0dd3f6
name: avml
arch: src
version: 0.3.0
epoch: 0
release: 1.el8
summary: AVML - Acquire Volatile Memory for Linux
url: https://github.com/microsoft/avml
rpm_license: MIT
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: avml-0.3.0-1.el8.src.rpm
checksum_type: sha256
description:
  AVML is an X86_64 userland volatile memory acquisition tool written in Rust, intended to be deployed as a static binary.
  AVML can be used to acquire memory without knowing the target OS distribution or kernel a priori. No on-target compilation or fingerprinting is needed.

  Features:
   * Save recorded images to external locations via Azure Blob Store or HTTP PUT
   * Automatic Retry (in case of network connection issues) with exponential backoff for uploading to Azure Blob Store
   * Optional page level compression using Snappy.
   * Uses LiME output format (when not using compression).

  Memory Sources
   * /dev/crash
   * /proc/kcore
   * /dev/mem


pkgId: 4da1e779030daf31c877594a8b5b569cdaf659c181cf863eeb3661227e714d45
name: bencode
arch: src
version: 4.0.0
epoch: 0
release: 1.el8
summary: The BitTorrent bencode module as light-weight, standalone package.
url: https://pypi.python.org/pypi/bencode
rpm_license: BitTorrent Open Source License
rpm_vendor: Thomas Rampelberg <thomas@bittorrent.com>
rpm_group: Development/Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: bencode-4.0.0-1.el8.src.rpm
checksum_type: sha256
description:
  This package simply re-packages the existing bencoding and bdecoding implemention from the 'official' BitTorrent client as a separate,
  light-weight package for re-using them without having the entire BitTorrent software as a dependency.


pkgId: 00e28b2d76ae8b99789c36e0a0a8459ce02fee244fecc778a3c7c1aa46e2f00c
name: bulk-reviewer
arch: src
version: 0.3.0
epoch: 0
release: 1.el8
url: https://github.com/bulk-reviewer/bulk-reviewer
rpm_license: GPL
rpm_group: Applications/File
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: bulk-reviewer-0.3.0-1.el8.src.rpm
checksum_type: sha256
summary:
  bulk-reviewer aids in identification, review, and removal of sensitive files in directories and disk images

description:
  Bulk Reviewer is an Electron desktop application that aids in identification, review, and
  removal of sensitive files in directories and disk images. Bulk Reviewer scans directories and
  disk images for personally identifiable information (PII) and other sensitive information using
  bulk_extractor, a best-in-class digital forensics tool. The desktop application enables users to:

    * Scan disk images and directories for private information with bulk_extractor (configurable with user-supplied regular expressions and stoplist files)
    * Review features found by type and by file in a user-friendly dashboard that supports annotation and dismissing features as false positives
    * Generate CSV reports of features found
    * Export sets of files
    * Cleared: Files free of PII
    * Private: Files with PII that should be restricted or run through redaction software

  Currently, Bulk Reviewer can scan directories and disk images for:

    * Social Security Numbers (SSNs)
    * Canadian Social Insurance Number (SINs)
    * Credit card numbers
    * Email addresses
    * Phone numbers
    * vCards (Virtual Contact Files)
    * URLs, web domains, RFC822 headers, and HTTP logs
    * GPS data
    * EXIF metadata
    * User-supplied regular expressions (uploaded as a txt file with each regexp on a new line)

  Scanners planned but not yet implemented include:

    * Personal names
    * Other national identifiers
    * Banking information (e.g. IBAN and SWIFT account numbers, ABA numbers)
    * Personal health information
    * Facebook and Outlook data
    * Additional lexicons (like those developed by the ePADD project team)

  The application is designed to aid archivists and librarians in processing and providing access
  to digital collections but may be useful in other domains as well. Bulk Reviewer has been made
  possible in part by the generous support of a Harvard Library Innovation Lab summer fellowship
  and a Concordia University Library Research Grant.


pkgId: 5925a00b7de7fe1ae8d3cf9591e24636a55a51f5740a0f59859dfc997bd5bb28
name: bulk_extractor
arch: src
version: 1.6.0
epoch: 0
release: 4.el8
url: http://digitalcorpora.org/downloads/bulk_extractor/
rpm_license: GPL
rpm_group: Applications/File
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: bulk_extractor-1.6.0-4.el8.src.rpm
checksum_type: sha256
summary:
  bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information

description:
  bulk_extractor is a C++ program that scans a disk image, a file, or a
  directory of files and extracts useful information without parsing the
  file system or file system structures. Useful information currently
  includes email addresses, URLs, credit card numbers, EXIF data
  structures, KML files, AES encryption keys (from RAM), IP packets, and
  other kinds of forensicly important information. Results are stored in
  text files (called feature files)
  that can be easily inspected, parsed, or processed with automated
  tools. The program is multi-threaded and will use all available
  cores. bulk_extractor also created a histograms of features that it finds,
  as features that are more common tend to be more important.


pkgId: 46a8dec7aa6cedfd7775fd3afa752a6768da49e0fcd60080dc937da7c5edc3b1
name: cert-forensics-tools-release
arch: src
version: 8
epoch: 0
release: 17
summary: CERT Forensics Tools Freeword Respository Configuration
url: http://www.cert.org/forensics
rpm_license: BSD
rpm_group: System Environment/Base
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: cert-forensics-tools-release-8-17.src.rpm
checksum_type: sha256
description:
  cert forensics tools freeworld repository contains open source and other
  distributable software for Fedora and CentOS/RHEL.

  This package contains the repository GPG key as well as configuration
  for the Yum, Smart, and APT-RPM package managers.


pkgId: fdd57a5dddbd527677b0215aca923cd88570cc686df273bdace30c1ffb13726a
name: certifi
arch: src
version: 2022.9.24
epoch: 0
release: 1.el8
summary: Python package for providing Mozilla's CA Bundle
url: http://certifi.io/en/latest/
rpm_license: MPLv2.0
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: certifi-2022.9.24-1.el8.src.rpm
checksum_type: sha256
description:
  Certifi is a carefully curated collection of Root Certificates for validating
  the trustworthiness of SSL certificates while verifying the identity of TLS
  hosts. It has been extracted from the Requests project.

  Please note that this Fedora package does not actually include a certificate
  collection at all. It reads the system shared certificate trust collection
  instead. For more details on this system, see the ca-certificates package.


pkgId: dfc538cef2622b7a535c7b667c80bbce84a6bbc87e1fe00675c0f4f7147f01e9
name: cffi
arch: src
version: 1.15.1
epoch: 0
release: 1.el8
summary: Foreign Function Interface for Python to call C code
url: http://cffi.readthedocs.org/
rpm_license: MIT
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: cffi-1.15.1-1.el8.src.rpm
checksum_type: sha256
description:
  Foreign Function Interface for Python, providing a convenient and
  reliable way of calling existing C code from Python. The interface is
  based on LuaJIT’s FFI.


pkgId: e34e2f96f093871536f821dfc604b7d554c3d474fac0d4e941d46e8be9216ea6
name: construct
arch: src
version: 2.5.2
epoch: 0
release: 4.el8
summary: A powerful declarative parser/builder for binary data
url: http://construct.readthedocs.org
rpm_license: MIT
rpm_group: Development/Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: construct-2.5.2-4.el8.src.rpm
checksum_type: sha256
description:
  Construct is a powerful declarative parser (and builder) for binary
  data.

  Instead of writing imperative code to parse a piece of data, you
  declaratively define a data structure that describes your data. As
  this data structure is not code, you can use it in one direction to
  parse data into Pythonic objects, and in the other direction, convert
  (build) objects into binary data.


pkgId: f10ce2fdcfb0f4f9651b7c6a4de8a91a44fb39a326862fbb131438e45cf1b228
name: crunch
arch: src
version: 3.6
epoch: 0
release: 1.el8
summary: Crunch - Generate wordlists from a character set
url: https://sourceforge.net/projects/crunch-wordlist/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: crunch-3.6-1.el8.src.rpm
checksum_type: sha256
description:
  Crunch can create a wordlist based on criteria you specify.  The outout
  from crunch can be sent to the screen, file,  or  to  another  program.
  The required parameters are:

  min-len
        The  minimum  length  string  you want crunch to start at.  This
        option is required even for parameters that won’t use the value.

  max-len
        The  maximum  length  string  you  want  crunch to end at.  This
        option is required even for parameters that won’t use the value.

  charset string
        You  may specify character sets for crunch to use on the command
        line or if you leave it blank crunch will use the default  char-
        acter sets.  The order MUST BE lower case characters, upper case
        characters, numbers, and then symbols.  If you don’t follow this
        order  you  will not get the results you want.  You MUST specify
        either values for the character type or a plus sign.   NOTE:  If
        you  want  to  include the space character in your character set
        you must escape it using the \ character or enclose your charac-
        ter  set in quotes i.e. "abc ".  See the examples 3, 11, 12, and
        13 for examples.


pkgId: 45725293525a6e138155d3f773437f0093b248e20236a8bdd9b8508d41a0b978
name: cryptcat
arch: src
version: 1.2.1
epoch: 0
release: 1.1.el8
summary: Standard netcat enhanced with twofish encryption.
url: http://cryptcat.sourceforge.net/
rpm_license: GPL
rpm_vendor: CERT Linux Forensics Tools Repository (LFTR) http://www.cert.org/forensics/repository
rpm_group: Applications/Internet
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers <lrr@cert.org>
location_href: cryptcat-1.2.1-1.1.el8.src.rpm
checksum_type: sha256
description:
  Cryptcat is the standard netcat enhanced with twofish encryption.
  netcat was origianally written by the l0pht (hobbit and weld pond).


pkgId: 204aafdd4265a14854fc8cd58242fbf47519ecf50882a91a9c594c010986e142
name: cutter-re
arch: src
version: 1.7.3
epoch: 0
release: 2.el8
summary: Cutter - A Qt and C++ GUI for the radare2 reverse engineering framework
url: https://github.com/radareorg/cutter
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: cutter-re-1.7.3-2.el8.src.rpm
checksum_type: sha256
description:
  Cutter is a Qt and C++ GUI for radare2. Its goal is making an advanced,
  customizable and FOSS reverse-engineering platform while keeping the
  user experience at mind. Cutter is created by reverse engineers for
  reverse engineers.


pkgId: f35cceb3a2da0bc8769180aec0a5ecf59f3661fd9e1931265331d45148ad2da4
name: daq
arch: src
version: 2.0.7
epoch: 0
release: 10.1.el8
summary: Data Acquisition Library
url: https://www.snort.org
rpm_license: GPLv2 and BSD
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: daq-2.0.7-10.1.el8.src.rpm
checksum_type: sha256
description:
  Snort 2.9 introduces the DAQ, or Data Acquisition library, for packet I/O.  The
  DAQ replaces direct calls to libpcap functions with an abstraction layer that
  facilitates operation on a variety of hardware and software interfaces without
  requiring changes to Snort.


pkgId: facab0eadd9d9421d4da2423dda8cfa1f7be78160b6a59813050591d6239ada2
name: dcp
arch: src
version: 1.0.6
epoch: 0
release: 1.el8
summary: dcp - copy and profile files and directories
url: https://github.com/nationalsecurityagency/dcp
rpm_license: MIT
rpm_vendor: NSA
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: dcp-1.0.6-1.el8.src.rpm
checksum_type: sha256
description:
  dcp combines cp, stat, md5sum and shasum to streamline mirroring and gathering
  information about all the files copied. All information gathered is written to
  an output file. The output file can be fed back into dcp when copying
  snapshots of a directory, this allows only files which differ in location or
  hash to be copied.


pkgId: 496d735c07aea4a6734fe27b0421da89295a8cc74dd5a99208f3e9226923ff42
name: ddrescueview
arch: src
version: 0.4.5
epoch: 0
release: 1.el8
summary: Graphically examine ddrescue's log files in a user friendly GUI
url: http://sourceforge.net/projects/ddrescueview/
rpm_license: GPL
rpm_group: Applications/System
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: ddrescueview-0.4.5-1.el8.src.rpm
checksum_type: sha256
description:
  This small tool allows the user to graphically examine ddrescue's log files
  in a user friendly GUI application. The Main window displays a block grid with
  each block's color representing the block types it contains. Many people know
  this type of view from defragmentation programs.  The program is written in
  Object Pascal using the Lazarus IDE. It can be compiled to run on Windows,
  GNU/Linux and probably OS X, too.  The downloads include binaries for the
  respective target platform and the project files (source code).


pkgId: 0d5a8e14eaaa09752fc4da03c9f2a7c4686851a5882492ee869d1b14f4ceff54
name: ddrutility
arch: src
version: 2.8
epoch: 0
release: 1.el8
summary: ddrutility - Utility for use with gnuddrescue to aid with data recovery
url: http://sourceforge.net/projects/ddrutility/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: ddrutility-2.8-1.el8.src.rpm
checksum_type: sha256
description:
  Ddrutility is meant to be a compliment to gnuddrescue. It is a set of
  utilities to help with hard drive data rescue. It currently contains
  the following utilities:

  	ddru_findbad
  	ddru_ntfsbitmap
  	ddru_ntfsfindbad (NEW)

  Please see the Wiki (http://sourceforge.net/p/ddrutility/wiki/Home/) or
  the help files for full documentation (note that the Wiki page does not
  seem to navigate properly, sorry). The readme file contains the latest
  news of updates, and can be viewed as text on the Files page.


pkgId: 54caef3361689693ed49bd2dc8866cbbd13c91df48c40577d0d0553ad1b77463
name: dfdatetime
arch: src
version: 20220925
epoch: 0
release: 1.el8
summary: Digital Forensics Date and Time (dfDateTime).
url: https://github.com/log2timeline/dfdatetime/wiki
rpm_license: Apache License, Version 2.0
rpm_vendor: dfDateTime development team <log2timeline-dev@googlegroups.com>
rpm_group: Development/Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: log2timeline development team <log2timeline-dev@googlegroups.com>
location_href: dfdatetime-20220925-1.el8.src.rpm
checksum_type: sha256
description:
  dfDateTime, or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.


pkgId: ab1512e834a922fb3b8f76f3d38e1a5bd1c79b29c81bfa79309fbddf9f807377
name: dfvfs
arch: src
version: 20220917
epoch: 0
release: 1.el8
summary: Digital Forensics Virtual File System (dfVFS).
url: https://github.com/log2timeline/dfvfs/wiki
rpm_license: Apache License, Version 2.0
rpm_vendor: "Log2Timeline developer" <log2timeline-dev@googlegroups.com>
rpm_group: Development/Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: dfvfs-20220917-1.el8.src.rpm
checksum_type: sha256
description:
  dfVFS, or Digital Forensics Virtual File System, provides read-only access to file-system objects
  from various storage media types and file formats. The goal of dfVFS is to provide a generic
  interface for accessing file-system objects, for which it uses several back-ends that provide
  the actual implementation of the various storage media types, volume systems and file systems.


pkgId: dd2972aed26784cb4f89814ac07fa0af2d420fe4c5c8ffd8898c7c69ebd5ea6e
name: dfwinreg
arch: src
version: 20211207
epoch: 0
release: 1.el8
summary: Library that provides read-only access to Windows Registry objects
url: https://github.com/log2timeline/dfwinreg/wiki
rpm_license: LGPL
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: dfwinreg-20211207-1.el8.src.rpm
checksum_type: sha256
description:
  dfWinReg, or Digital Forensics Windows Registry, provides read-only
  access to Windows Registry objects. The goal of dfWinReg is to provide a
  generic interface for accessing Windows Registry objects that resembles
  the Registry key hierarchy as seen on a live Windows system.

  dfWinReg originates from the Plaso project and is also based on ideas
  from the winreg-kb project. It was largely rewritten and made into a
  stand-alone project to provide more flexibility and allow other projects
  to make use of Windows Registry functionality.


pkgId: d2b83deefcc3fbd4eab3fc516a1e9cb389c54b3915c5682710c5c837dda02119
name: disktype
arch: src
version: 9
epoch: 0
release: 30.1.el8
summary: Detect the content format of a disk or disk image
url: http://disktype.sourceforge.net/
rpm_license: MIT
rpm_group: Applications/File
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: disktype-9-30.1.el8.src.rpm
checksum_type: sha256
description:
  The purpose of disktype is to detect the content format of a disk or disk
  image. It knows about common file systems, partition tables, and boot codes.


pkgId: 8e59d4dbb936986a6d170b6b47e52970f40878d1535cd2e226038b1937695c4b
name: distorm3
arch: src
version: 3.5.0
epoch: 0
release: 1.el8
summary: distorm3 - binary stream disassembler library
url: https://github.com/gdabah/distorm
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: distorm3-3.5.0-1.el8.src.rpm
checksum_type: sha256
description:
  diStorm is a lightweight, easy-to-use and fast decomposer library.  It disassembles instructions
  in 16, 32 and 64 bit modes.  Supported instruction sets: FPU, MMX, SSE, SSE2, SSE3, SSSE3,
  SSE4, 3DNow! (w/ extensions), new x86-64 instruction sets, VMX, AMD's SVM and AVX!


pkgId: 6935b566732f15f980baefd4d5d956c9689f91bcc9336119e30c818c0807139d
name: docker-forensics-toolkit
arch: src
version: 0.2.0
epoch: 0
release: 3.el8
url: https://github.com/docker-forensics-toolkit/toolkit
rpm_license: ASL 2
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: docker-forensics-toolkit-0.2.0-3.el8.src.rpm
checksum_type: sha256
summary:
  docker-forensics-toolkit - toolkit for performing post-mortem analysis of Docker runtime environments

description:
  This package contains a toolkit for performing post-mortem analysis of Docker runtime environments based on forensic HDD copies of the docker host system.

  Features:
   * mount-image - Mounts the forensic image of the docker host
   * status - Prints status information about the container runtime
   * list-images - Prints images found on the computer
   * show-image-history - Displays the build history of an image
   * show-image-config - Pretty prints the full config file of an image
   * list-containers - Prints containers found on the computer
   * show-container-log - Displays the latest container logfiles
   * show-container-config - Pretty prints the combined container specific config files (config.v2.json and hostconfig.json).
   * mount-container - Mounts the file system of a given container at the given location (overlay2 only)
   * macrobber-container-layer - Extracts file system metadata from the container layer of the given container. Use the output with the 'mactime' tool to create a timeline.
   * macrobber-volumes - Extracts file system metadata from the volumes of the given container. Use the output with the 'mactime' tool to create a timeline.
   * carve-for-deleted-docker-files - Carves the image for deleted Docker files, such as container configs,Dockerfiles and deleted log files. Requires 'scalpel' to be installed.


pkgId: 932782fa5405fd43d0d68779c3cbeca16f375435370f939e510bfee5094cc471
name: dpapick
arch: src
version: 0.3
epoch: 0
release: 1.el8
summary: DPAPI decryption toolkit
url: http://www.dpapick.com
rpm_license: GPL-3.0
rpm_group: Development/Languages/Python
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: dpapick-0.3-1.el8.src.rpm
checksum_type: sha256
description:
  OVERVIEW

  DPAPIck is a python toolkit to provide a platform-independant implementation
  of Microsoft's cryptography subsytem called DPAPI (Data Protection API).

  It can be used either as a library or as a standalone tool.

  It is also the first open-source tool that allows decryption of DPAPI
  structures in an offline way and, moreover, from another plateform than
  Windows.

  It is provided with some application probes that includes the built-in logic
  to retreive the corresponding secrets that are protected.

  To have more information or to contact us, go to our website:
  http://www.dpapick.com


  REQUIREMENTS

  This application has been developped and tested on python 2.7.

  M2Crypto is required to provide all the requireds algorithms. To obtain it,
  see: http://chandlerproject.org/bin/view/Projects/MeTooCrypto

  Probes and other tool may require other modules to be able to retreive
  information such as:
    * python-sqlite3 for Google Chrome password database
    * CFPropertyList for Apple Safari keychain.plist
        see https://github.com/bencochran/CFPropertyList
    * python-registry for low-level manipulation of hives
        see https://github.com/williballenthin/python-registry
    * pyASN1 for the RSA key pair manipulation
        see http://pyasn1.sourceforge.net/

  We also recommend the use of MoonSols Windows Memory Toolkit to convert
  hibernation file to usable memory dumps and be able to extract credentials
  from it.
  For more information about Moonsols products, see <http://www.moonsols.com>


  AUTHOR

  DPAPIck is written by Jean-Michel Picod (jean-michel.picod@cassidian.com)
  with the help from Ivan Fontarensky (ivan.fontarensky@cassidian.com)
  who work for the Cyber Security Center of Cassidian, an EADS company,
  and Elie Bursztein (dpapi@elie.im)


  LICENSE

  This program is free software: you can redistribute it and/or modify
  it under the terms of the GNU General Public License as published by
  the Free Software Foundation version 3 of the License.

  This program is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  GNU General Public License for more details.

  You should have received a copy of the GNU General Public License
  along with this program.  If not, see <http://www.gnu.org/licenses/>.


pkgId: 5aa6d9dad0d2559c32cd2d2df38d45bb4cae2084a09c873cffce729474f38596
name: elasticsearch
arch: src
version: 7.17.4
epoch: 0
release: 1.el8
summary: Python package for ElasticSearch
url: https://pypi.org/project/elasticsearch7/
rpm_license: BSD
rpm_vendor: cert.org
rpm_group: Applications
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: elasticsearch-7.17.4-1.el8.src.rpm
checksum_type: sha256
description:
  Official low-level client for Elasticsearch. Its goal is to provide common ground for all
  Elasticsearch-related code in Python; because of this it tries to be opinion-free and very
  extendable.

  For a more high level client library with more limited scope, have a look at elasticsearch-dsl -
  a more pythonic library sitting on top of elasticsearch-py.

  It provides a more convenient and idiomatic way to write and manipulate queries. It stays close
  to the Elasticsearch JSON DSL, mirroring its terminology and structure while exposing the whole
  range of the DSL from Python either directly using defined classes or a queryset-like expressions.

  It also provides an optional persistence layer for working with documents as Python objects in
  an ORM-like fashion: defining mappings, retrieving and saving documents, wrapping the document
  data in user-defined classes.


pkgId: 534accb87e3c118567511b610e04385ef8a0c3d91570d55b5fab53f6bf285cf0
name: epub
arch: src
version: 0.5.2
epoch: 0
release: 1.el8
summary: Extract thumbnails and associated metadata from the Thumbs.db files
url: http://pypi.python.org/pypi/epub/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: epub-0.5.2-1.el8.src.rpm
checksum_type: sha256
description:
  EPUB is the distribution and interchange format standard for digital
  publications and documents based on Web Standards. EPUB defines a moyen de
  Representing, packaging and encoding structured and Semantically enhanced
  Web content - Including XHTML, CSS, SVG, images, and other resources -
  for distribution in a single-file format.

  EPUB allows publishers to Produce and send a single digital publication
  file through distribution and offers interoperability Between Consumers
  software / hardware for unencrypted reflowable digital books and other
  publications.


pkgId: 48e938fef2009449f17e2a44f931cbb50bd2ffe5d1dbee96dc125057675a6f16
name: fatback
arch: src
version: 1.3
epoch: 0
release: 1.el8
summary: Undelete files from FAT file systems
url: https://sourceforge.net/projects/fatback/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fatback-1.3-1.el8.src.rpm
checksum_type: sha256
description:
  Fatback is a forensic tool for undeleting files from Microsoft FAT
  file systems.  Fatback is different from other undelete tools in that
  it does the following:

     * Runs under UNIX environments (only Linux and FreeBSD tested so far)

     * Can undelete files automatically

     * Supports Long File Names

     * Supports FAT12, FAT16, and FAT32

     * Powerful interactive mode

     * Recursively undeletes deleted directories

     * Recovers lost cluster chains

     * Works with single partitions or whole disks

     Fatback was developed by the U.S. Department of Defense Computer
  Forensics Laboratory (<http://www.dcfl.gov>) and is authorized for
  *government and law enforcement use only*.


pkgId: ba31b1487ef6e54fb14a80229e8349449606f4b07ccc86ae977758074ae3b5d4
name: fcrackzip
arch: src
version: 1.0
epoch: 0
release: 1.el8
summary: fcrackzip - a Free/Fast Zip Password Cracker
url: http://oldhome.schmorp.de/marc/fcrackzip.html
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fcrackzip-1.0-1.el8.src.rpm
checksum_type: sha256
description:
  Fcrackzip searches each zipfile given for encrypted files and tries to
  guess the password. All files must be encrypted with the same password,
  the more files you provide, the better.


pkgId: 079f0c06890430dd3b4e81bc5723683173cc379918dcd2bec6dee4222cccdd36
name: femto
arch: src
version: 1.3.0
epoch: 0
release: 1.el8
summary: femto - indexing and search system for queries on sequences of bytes
url: https://github.com/femto-dev/femto
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: femto-1.3.0-1.el8.src.rpm
checksum_type: sha256
description:
  FEMTO is an indexing and search system for queries on sequences of
  bytes. FEMTO stands for the FM-index for External Memory with Throughput
  Optimizations. This tool supports building large indexes in parallel
  with MPI and then searching large indexes with a multithreaded server.


pkgId: e75cf49f79291a0204840c20c40ff30d93ca51ba8503c1334ff524f7c6007c16
name: fmem-kernel-modules-common
arch: src
version: 1.6
epoch: 0
release: 1.6
summary: This package contains the source code for making FMEM Modules
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-6-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-common-1.6-1.6.src.rpm
checksum_type: sha256
description:
  This package provides a script to install and use the kernel objects.
  These modules are now packaged separately.
  This package is intended to be shared across all OSes and architectures


pkgId: d8551b3436a361e897e53d67303b88ac4117b8d873aa48002e53adf5c3753799
name: fmem-kernel-modules-el9-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.14
description: This package provides kernel objects for CentOS 9 Stream x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-9-stream-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-el9-x86_64-1.6-1.14.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for CentOS 9 Stream x86_64 for FMEM


pkgId: 0b5a6de1c10179c2fe310d91c1fa109f77d4eb0dc55e9cb528fa2249862102de
name: fmem-kernel-modules-fc22-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.36
description: This package provides kernel objects for Fedora 22 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-22-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc22-x86_64-1.6-1.36.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 22 x86_64 for FMEM


pkgId: 9bae30c49cded5e248435ca889c78d8befda71788ee0ba5a48208be8e0246a93
name: fmem-kernel-modules-fc23-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.36
description: This package provides kernel objects for Fedora 23 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc23-x86_64-1.6-1.36.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 23 x86_64 for FMEM


pkgId: 9467f98efe59735fe7615e0f02bb6a79f43951b41b6deb2937c16a5077253993
name: fmem-kernel-modules-fc24-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.47
description: This package provides kernel objects for Fedora 23 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-24-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc24-x86_64-1.6-1.47.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 24 x86_64 for FMEM


pkgId: 62b668ba84aa638df6204b26041e9345205b257204df8ec72a71bf1eddcc3f9a
name: fmem-kernel-modules-fc25-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.50
description: This package provides kernel objects for Fedora 23 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-25-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc25-x86_64-1.6-1.50.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 25 x86_64 for FMEM


pkgId: f2147b831222c419d03ba58d1207163e67bf9f3d3ddfb92a237150494aeb344c
name: fmem-kernel-modules-fc26-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.38
description: This package provides kernel objects for Fedora 26 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-26-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc26-x86_64-1.6-1.38.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 26 x86_64 for FMEM


pkgId: 43322fa79c2f0ac4eb80af2b97b330dd54b11b4e381456586082211fbf57d41a
name: fmem-kernel-modules-fc27-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.44
description: This package provides kernel objects for Fedora 23 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-27-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc27-x86_64-1.6-1.44.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 27 x86_64 for FMEM


pkgId: 92cde26acd46c8d9c841c0a6cabd9a22cc43afad7cc2c3f18761a5bc959aecc4
name: fmem-kernel-modules-fc28-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.42
description: This package provides kernel objects for Fedora 28 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-28-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc28-x86_64-1.6-1.42.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 28 x86_64 for FMEM


pkgId: 0e12e96bdb09bc0e4d9e20f19d767afb736b35501e13060af5f2e4414880e3b7
name: fmem-kernel-modules-fc29-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.37
description: This package provides kernel objects for Fedora 29 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-29-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc29-x86_64-1.6-1.37.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 29 x86_64 for FMEM


pkgId: 258995ad090b11f04f9b5e7e33a239ba36daac70b8b74ff67ca4a645c582c925
name: fmem-kernel-modules-fc30-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.39
description: This package provides kernel objects for Fedora 30 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-30-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc30-x86_64-1.6-1.39.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 30 x86_64 for FMEM


pkgId: 098505e741e0a7ba93dfbea1d068abcf85199be4fb5f476446bba90f6914289e
name: fmem-kernel-modules-fc31-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.40
description: This package provides kernel objects for Fedora 31 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-31-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc31-x86_64-1.6-1.40.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 31 x86_64 for FMEM


pkgId: db047bf1edfa2811610636e48b1352ccd77390f14eb0058a2a896f1cc69a1a36
name: fmem-kernel-modules-fc32-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.46
description: This package provides kernel objects for Fedora 32 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-32-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc32-x86_64-1.6-1.46.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 32 x86_64 for FMEM


pkgId: 4871be865e78f187b544a2f32bbf6cbeda9e9b1ebc8ff81c4c998d6f9ae120ae
name: fmem-kernel-modules-fc33-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.46
description: This package provides kernel objects for Fedora 33 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-33-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc33-x86_64-1.6-1.46.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 33 x86_64 for FMEM


pkgId: 8095b7090ba13734c7d31c253978e589855ce3a0632f507493c559c3bc8c1e14
name: fmem-kernel-modules-fc34-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.51
description: This package provides kernel objects for Fedora 34 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-34-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc34-x86_64-1.6-1.51.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 34 x86_64 for FMEM


pkgId: 5c8a0c998945952ee0a42eec8c0c3b6f3a75924e1e3f29fb3b0e65a53221ee8d
name: fmem-kernel-modules-fc35-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.41
description: This package provides kernel objects for Fedora 35 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-35-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc35-x86_64-1.6-1.41.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 35 x86_64 for FMEM


pkgId: e26283f858374702a0fd704128fc655896f80bb9de472ae1e3f2cdac202a8cf8
name: fmem-kernel-modules-fc36-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.17
description: This package provides kernel objects for Fedora 36 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-36-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc36-x86_64-1.6-1.17.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 36 x86_64 for FMEM


pkgId: 4807e6d8283d19074e0f77a27a34bb0e512d929a3bbb117994c57ca4ed0c0b89
name: foremost
arch: src
version: 1.5.7
epoch: 0
release: 27.el8
summary: Recover files by "carving" them from a raw disk
url: http://foremost.sf.net
rpm_license: Public Domain
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: foremost-1.5.7-27.el8.src.rpm
checksum_type: sha256
description:
  Foremost recovers files files based on their headers, footers, and internal
  data structures. This process is commonly referred to as data carving.
  Foremost can work on a raw disk drive or image file generated by dd.  The
  headers and footers can be specified by a configuration file or you can use
  command line switches to specify built-in file types. These built-in types
  look at the data structures of a given file format allowing for a more
  reliable and faster recovery.


pkgId: 5547ef8e3405e9ba5b4b42eb93092abc9a99a59fb68db255e2d88cb94dac96b5
name: fuse-python
arch: src
version: 1.0.4
epoch: 0
release: 1.el8
summary: Python bindings for FUSE - filesystem in userspace
url: http://sourceforge.net/apps/mediawiki/fuse/index.php?title=FusePython
rpm_license: LGPLv2
rpm_vendor: CERT Linux Forensics Tools Repository (LFTR) http://www.cert.org/forensics/repository
rpm_group: System Environment/Base
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers <lrr@cert.org>
location_href: fuse-python-1.0.4-1.el8.src.rpm
checksum_type: sha256
description:
  This package provides python bindings for FUSE. FUSE makes it possible
  to implement a filesystem in a userspace program.


pkgId: 79d8a193f1bfb8190c6c11b9cc65e8b4f8059e93e97cda24f3987f210625f469
name: future
arch: src
version: 0.18.2
epoch: 0
release: 2.1.el8
summary: Easy, clean, reliable Python 2/3 compatibility
url: http://python-future.org/
rpm_license: MIT
rpm_group: Applications/Engineering
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: future-0.18.2-2.1.el8.src.rpm
checksum_type: sha256
description:
  future is the missing compatibility layer between Python 2 and
  Python 3. It allows you to use a single, clean Python 3.x-compatible
  codebase to support both Python 2 and Python 3 with minimal overhead.

  It provides ``future`` and ``past`` packages with backports and forward
  ports of features from Python 3 and 2. It also comes with ``futurize`` and
  ``pasteurize``, customized 2to3-based scripts that helps you to convert
  either Py2 or Py3 code easily to support both Python 2 and 3 in a single
  clean Py3-style codebase, module by module.


pkgId: 3dcebc98a891b1131613d61e6e89e622c1f26fafce8c6ab3c18584df53672e03
name: galleta
arch: src
version: 20040505_1
epoch: 0
release: 1.el8
summary: Examine the contents of cookie files
url: http://sourceforge.net/projects/odessa/files/Galleta/
rpm_license: GPL
rpm_vendor: lrr@cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: galleta-20040505_1-1.el8.src.rpm
checksum_type: sha256
description:
  Galleta, the Spanish word meaning "cookie", was developed to examine the
  contents of the cookie files. Galleta will parse the information in a
  Cookie file and output the results in a field delimited manner so that
  it may be imported into your favorite spreadsheet program. Galleta is
  built to work on multiple platforms and will execute on Windows (through
  Cygwin), Mac OS X, Linux, and *BSD platforms.


pkgId: 8b5e2a7b704cff376f3891cd4226173416477590b891b5147c5ef2ac577c3581
name: gengetopt
arch: src
version: 2.23
epoch: 0
release: 1.el8
summary: Tool to write command line option parsing code for C programs
url: http://www.gnu.org/software/gengetopt/
rpm_license: GPLv3+
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: gengetopt-2.23-1.el8.src.rpm
checksum_type: sha256
description:
  Gengetopt is a tool to generate C code to parse the command line arguments
  argc and argv that are part of every C or C++ program. The generated code uses
  the C library function getopt_long to perform the actual command line parsing.


pkgId: 06f0691f8538a8b2cf27fbb076cb4dd7e83021dd1dac32a93e268fe8b95ab008
name: ghidra
arch: src
version: 10.1.5
epoch: 0
release: PUBLIC_20220726.1.el8
summary: ghidra - Software reverse engineering (SRE) suite of tools
url: https://www.nsa.gov/resources/everyone/ghidra/
rpm_license: Apache 2.0
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: ghidra-10.1.5-PUBLIC_20220726.1.el8.src.rpm
checksum_type: sha256
description:
  Ghidra is a software reverse engineering (SRE) framework developed
  by NSA's Research Directorate for NSA's cybersecurity mission. It
  helps analyze malicious code and malware like viruses, and can give
  cybersecurity professionals a better understanding of potential
  vulnerabilities in their networks and systems.


pkgId: 2ec4de93918ace94fd42457bce612a28b85fca0cdcfd8a060d03da9c31c65273
name: grokevt
arch: src
version: 0.5.0
epoch: 0
release: 2.el8
summary: Read and process Windows Event Files
url: http://projects.sentinelchicken.org/grokevt/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: grokevt-0.5.0-2.el8.src.rpm
checksum_type: sha256
description:
  GrokEVT is a collection of scripts built for reading Windows NT event
  log files. GrokEVT is released under the GNU GPL, and is implemented
  in Python. GrokEVT is loosely based on the PHP script and documentation
  provided by Jamie French.

  Currently the scripts work together on one or more mounted Windows
  partitions to extract all information needed (registry entries, message
  templates, and log files) to convert the logs to a human-readable format.


pkgId: f2ad38c085a600615c741790bb72d932ab281b78c25e723bc498c66cbb22cb38
name: guymager
arch: src
version: 0.8.13
epoch: 0
release: 1.el8
summary: Imager for forensic media acquisition
url: http://guymager.sourceforge.net/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: guymager-0.8.13-1.el8.src.rpm
checksum_type: sha256
description:
  guymager is an imager for forensic media acquisition. Its main features are:

      * Easy user interface in different languages
      * Runs under Linux
      * Multi-threaded design, multi-threaded data compression
      * Makes full usage of multi-processor machines
      * Generates flat (dd) and EWF (E01) images


pkgId: 06171920b624d37c4e8b34368ff8860a0b430e1cd35ea058ff74847602cb7389
name: hachoir
arch: src
version: 3.1.2
epoch: 0
release: 3.el8
summary: Library for carving binary files
url: https://bitbucket.org/haypo/hachoir/wiki/Home
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: hachoir-3.1.2-3.el8.src.rpm
checksum_type: sha256
description:
  Hachoir is a Python library used to represent of a binary file as a tree of
  Python objects. Each object has a type, a value, an address, etc. The goal is
  to be able to know the meaning of each bit in a file.

  Why using slow Python code instead of fast hardcoded C code? Hachoir has many
  interesting features:

   * Autofix: Hachoir is able to open invalid / truncated files
   * Lazy: Open a file is very fast since no information is read from file,
     data are read and/or computed when the user ask for it
   * Types: Hachoir has many predefined field types (integer, bit, string, etc.)
     and supports string with charset (ISO-8859-1, UTF-8, UTF-16, ...)
   * Addresses and sizes are stored in bit, so flags are stored as classic fields
   * Endian: You have to set endian once, and then number are converted in the
     right endian
   * Editor: Using Hachoir representation of data, you can edit, insert, remove
     data and then save in a new file.


pkgId: a6e0e8e8b2d5126ce8034c42135917588bc5fe0d87ffbe6afbf2358d93da754b
name: haystack
arch: src
version: 0.42
epoch: 0
release: 3.el8
summary: Search C Structures in a process' memory
url: https://github.com/trolldbois/python-haystack
rpm_license: GPL
rpm_group: Development/Languages/Python
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: haystack-0.42-3.el8.src.rpm
checksum_type: sha256
description:
  [![Build Status](https://travis-ci.org/trolldbois/python-haystack.svg?branch=master)](https://travis-ci.org/trolldbois/python-haystack)
  [![Coverage Status](https://coveralls.io/repos/trolldbois/python-haystack/badge.svg?branch=master&service=github)](https://coveralls.io/github/trolldbois/python-haystack?branch=master)
  [![Code Health](https://landscape.io/github/trolldbois/python-haystack/master/landscape.svg?style=flat)](https://landscape.io/github/trolldbois/python-haystack/master)
  [![pypi](https://img.shields.io/pypi/dm/haystack.svg)](https://pypi.python.org/pypi/haystack)

  Quick Start:
  ============
  [Quick usage guide](docs/Haystack basic usage.ipynb) in the docs/ folder.
  [Haystack-reverse CLI](docs/Haystack reverse CLI.ipynb) in the docs/ folder.

  Introduction:
  =============

  python-haystack is an heap analysis framework, focused on searching and reversing of
  C structure in allcoated memory.

  The first function/API is the SEARCH function.
   - It gives the ability to search for known record types in a process memory dump or live process's memory.

  The second function/API is the REVERSE function.
   - It aims at helping an analyst in reverse engineering the memory records types present in a process heap.
  It focuses on reconstruction, classification of classic C structures from memory.
  It attempts to recreate types definition.

  Scripts & Entry Points:
  =======================

  A few entry points exists to handle the format your memory dump.

  Memory dump folder produced by `haystack-live-dump`
  ---------------------------------------------------
   - `haystack-find-heap` allows to show details on Windows HEAP.
   - `haystack-search` search CLI
   - `haystack-show` show CLI for specific record type at a specific address
   - `haystack-reverse` reverse CLI - reverse all allocation chunks
   - `haystack-reverse-show` show the reversed record at a specific address
   - `haystack-reverse-hex` show a specific record hex bytes at a specific address
   - `haystack-reverse-parents` show the records pointing to the allocated record at a specific address

  Memory dump file produced by a Minidump tool
  ---------------------------------------------------
   - `haystack-find-heap` allows to show details on Windows HEAP.
   - `haystack-minidump-search` search CLI
   - `haystack-minidump-show` show a specific record type at a specific address
   - `haystack-minidump-reverse` reverse CLI - reverse all allocation chunks
   - `haystack-minidump-reverse-show` show the reversed record at a specific address
   - `haystack-minidump-reverse-hex` show a specific record hex bytes at a specific address
   - `haystack-minidump-reverse-parents` show the records pointing to the allocated record at a specific address

  For live processes
  ------------------
   - `haystack-live-dump` capture a process memory dump to a folder (haystack format)
   - `haystack-live-search` search CLI in live process memory
   - `haystack-live-show` show a specific record type at a specific addres in a live process memory

  For a Rekall memory dump
  ---------------------------
   - `haystack-rekall-search` search CLI for a specific process in a rekall dump
   - `haystack-rekall-show` show a specific record type at a specific address
   - `haystack-rekall-dump` dump a specific process to a haystack process dump

  For a Volatility memory dump
  ---------------------------
   - `haystack-volatility-search`  search CLI for a specific process in a volatility dump
   - `haystack-volatility-show` show a specific record type at a specific address
   - `haystack-volatility-dump` dump a specific process to a haystack process dump

  How to get a memory dump:
  =========================

  On Windows, the most straightforward is to get a Minidump. The Microsoft Sysinternals
  suite of tools provide either a CLI (procdump.exe) or a GUI (Process explorer).
  Using one of these (with full memory dump option) you will produce a file
  that can be used with the `haystack-minidump-xxx` list of entry points.

  While technically you could use many third party tool, haystack actually
  need memory mapping information to work with.
  So there is a dumping tool included `haystack-live-dump`:

      

  You can easily reproduce the format of the dump, its a folder/archive
  containing each memory map in a separate file :

  - memory content in a file named after it's start/end addresses ( 0x000700000-0x000800000 )
  - 'mappings' file containing memory mappings metadata.  ( mappings )

  Or you can code a `haystack.abc.IMemoryMapping` implementation for your favorite format.

  Otherwise, if you already have a system memory dump from Volatility or Rekall,
  you can use the `haystack-rekall-xxx` or `haystack-volatility-xxx` families of
  entry points to extract a specific process memory into a file.

  Verifying Windows Heap attributes:
  ==================================

  The entry point `haystack-find-heap` allows to show details on Windows HEAP.
  It should support:

  - Windows XP 32 bits
  - Windows XP 64 bits
  - Windows 7 32 bits
  - Windows 7 64 bits

  and show details of the Look Aside List (LAL) and Low Fragmentation Heap (LFH) frontend.

  You might be surprised to see that sometimes, a single process can mix the two types of HEAP (32 & 64).

  Search for known structures:
  ============================

  To search for a specific record, you will first need to define that record type.
  A [quick usage guide](docs/Haystack basic usage.ipynb) is available to go
  over the basic steps to go from a C Header file to a Python ctypes definition.
  Or you can do it yourself, with traditional Python ctypes records.

  The search api is available through the `haystack-xxx-search` family of scripts but
  also in an API so that you can embed that search in your own code.

  In short, the haystack search will iterate over every offset of the program's
  memory to try and find 'valid' offset for that specific record type.

  The validity of the record is determined by type constraints such as:
  - pointer field should have valid address space values
  - user-defined type constraints (see 'Constraints file' section below)
  - etc..

  Constraints file:
  -----------------

  The following constraints are supported:
   - IgnoreMember: The value of this field will be ignored. Useful to Ignore pointer fields.
   - NotNull: The value of this field must not be 0.
   - RangeValue(x,y): the field must have a value between x and y.
   - PerfectMatch('hello world'): the field (a string) must match 'hello world'
   - [1,2,3]: A list of values that the fields should have
   - [1, RangeValue(12,16), 42]: The field value should be 1, 12-16 or 42.


  Example:

      [struct_name]
      myfield: [1,0xff]
      ptr_field: NotNull

  You can take a look a `haystack/structures/win32/winxpheap32.constraints`, where
  the constraints of a Windows XP HEAP x32 are defined.

  Obviously, the more constraints, the better the results will be.

  Dynamic constraints definition:
  -------------------------------
  You can also create more complex constraints using python code by implementing
  a `haystack.abc.interface.IRecordTypeDynamicConstraintsValidator` class and feeding it to
  the `ModuleConstraints.set_dynamic_constraints`

  Command line example:
  ---------------------

  **sslsnoop repository needs an update to be compatible with releases > v0.30 - pending**

  For example, this will dump the session_state structures + pointed
  children structures as an python object that we can play with.
  Lets assume we have an ssh client or server as pid *4042*:

      $ sudo haystack-live-search --pickled 4042 sslsnoop.ctypes_openssh.session_state search > instance.pickled
      $ sudo haystack-live-search --pickled 4042 sslsnoop.ctypes_openssh.session_state refresh 0xb8b70d18 > instance.pickled
      $ sudo haystack-live-search --pickled <pid> <your ctypes Structure> search


  Graphic example :
  -----------------

  **This is not working right now**

  There is also an attempt at a Graphical GUI ( Qt4 )
  Dump the process, then you can open it in the GUI::

      $ haystack-gui # ( and Ctrl-O , click click)
      $ haystack-gui --dumpname dumps/myssh.dump

  You can the search a structure from the heap of that memory mapping.

  You have to import your extensions before that to have them listed in
  the search dialog.


  python API example:
  -------------------

  See the [quick usage guide](docs/Haystack basic usage.ipynb)


  How to define your own structures:
  ----------------------------------

  The most easy way is to use ctypeslib to generate ctypes records from
  C Headers.

  Or define your python ctypes record by hand.


  Heap analysis / forensics:
  ==========================

  Quick info:
   - The `haystack-xxx-reverse` family of entry points parse the heap for
   allocator structures, pointers values, small integers and text (ascii/utf).
   Given all the previous information, it can extract instances and helps you
   in classifying and defining structures types.

  IPython notebook usage guide:
   - [Haystack-reverse CLI](docs/Haystack reverse CLI.ipynb) in the docs/ folder.

  Command line example:
  --------------------
  The first step is to launch the analysis process with the `haystack-xxx-reverse` entry point.
  This will create several files in the `cache/` folder in the memory dump folder:

      $ haystack-reverse haystack/test/src/test-ctypes6.64.dump
      $ ls -l haystack/test/src/test-ctypes6.64.dump/cache
      $ ls -l haystack/test/src/test-ctypes6.64.dump/cache/structs

  This will create a few files. The most interesting one being the `<yourdumpfolder>/cache/xxxxx.headers_values.py` that
  gives you an ctypes listing of all found structures, with guesstimates
  on fields types.

  A `<yourdumpfolder>/cache/graph.gexf` file is also produced to help you visualize
  instances links. It gets messy for any kind of serious application.

  - `*.headers_values.py` contains the list of heuristicly reversed record types.
  - `*.strings` contains the list of heuristicly typed strings field in reversed record.

  Other Entry points for reversing:
  --------------------------------

   - `haystack-reverse-show` show a specific record at a specific address
   - `haystack-reverse-hex` show a specific record hex bytes at a specific address
   - `haystack-reverse-parents` show the records pointing to the allocated record at a specific address
   - `haystack-minidump-reverse-show` show a specific record at a specific address
   - `haystack-minidump-reverse-hex` show a specific record hex bytes at a specific address
   - `haystack-minidump-reverse-parents` show the records pointing to the allocated record at a specific address


  Extension examples :
  ====================
  @ see sslsnoop in the Pypi repo. openssl and nss structures are generated.

  @ see ctypes-kernel on my github. Linux kernel structure are generated from a build kernel tree. (VMM is abitch)



  not so FAQ :
  ============

  What does it do ?:
  ------------------
  The basic functionality is to search in a process' memory for a
  specific C Record.

  The extended reverse engineering functionality aims at reversing
  structures from memory/heap analysis.

  How do it knows that the structures is valid ? :
  ------------------------------------------------
  You add some constraints on the record fields expected values.
  Pointers are always constrained to valid memory space.

  Where does the idea comes from ? :
  -----------------------------------
  http://www.hsc.fr/ressources/breves/passe-partout.html.fr originally.
  since I started in March 2011, I have uncovered several other related
  previous work.

  Most of them are in the docs/ folder.

  Other related work are mona.py from Immunity, some other Mandiant stuff...

  In a nutshell, this is probably not an original idea. But yet, I could
  not find a operational standalone lib for live memory extraction for my sslsnoop PoC, so....


  What are the dependencies ? :
  ----------------------------

  - python-ptrace on linux
  - winappdbg on win32 ( not sure if working, feedback welcome)
  - python-numpy
  - python-networkx
  - python-levenshtein
  - several others...

  Others
  ------
  http://ntinfo.biz/ xntsv32


pkgId: ad589a2653ed20e1fbe035bbd7a0fe59e47503e642c7f2825bcca8f656337831
name: hindsight
arch: src
version: 2021.12
epoch: 0
release: 2.el8
summary: Internet history forensics for Google Chrome/Chromium
url: https://github.com/obsidianforensics/hindsight
rpm_license: GPL3
rpm_group: Applications
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: hindsight-2021.12-2.el8.src.rpm
checksum_type: sha256
description:
  Hindsight is a free tool for analyzing web artifacts. It started with the browsing history
  of the Google Chrome web browser and has expanded to support other Chromium-based applications
  (with more to come!). Hindsight can parse a number of different types of web artifacts, including
  URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences,
  browser extensions, HTTP cookies, and Local Storage records (HTML5 cookies). Once the data is
  extracted from each file, it is correlated with data from other history files and placed in
  a timeline.indsight is a free tool for analyzing web artifacts. It started with the browsing
  history of the Google Chrome web browser and has expanded to support other Chromium-based
  applications (with more to come!). Hindsight can parse a number of different types of web
  artifacts, including URLs, download history, cache records, bookmarks, autofill records,
  saved passwords, preferences, browser extensions, HTTP cookies, and Local Storage records
  (HTML5 cookies). Once the data is extracted from each file, it is correlated with data from
  other history files and placed in a timeline.


pkgId: 67e221660b06a94fa14355bf57d1fd06fff8fb581e407935fbc024d2b99cd824
name: idna
arch: src
version: 3.3
epoch: 0
release: 1.el8
summary: Internationalized Domain Names in Applications (IDNA)
url: https://github.com/kjd/idna
rpm_license: BSD and Python and Unicode
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: idna-3.3-1.el8.src.rpm
checksum_type: sha256
description:
  A library to support the Internationalised Domain Names in Applications (IDNA)
  protocol as specified in RFC 5891 <http://tools.ietf.org/html/rfc5891>.  This
  version of the protocol is often referred to as "IDNA2008" and can produce
  different results from the earlier standard from 2003.

  The library is also intended to act as a suitable drop-in replacement for the
  "encodings.idna" module that comes with the Python standard library but
  currently only supports the older 2003 specification.


pkgId: b892e3ce6e3f0cb65d8d152e7c5d2f075f01b760523fb90e5e49aac8e5b45a74
name: ioc_writer
arch: src
version: 0.3.3
epoch: 0
release: 1.el8
summary: API providing a limited CRUD for manipulating OpenIOC formatted Indicators of Compromise
url: http://www.github.com/mandiant/ioc_writer/
rpm_license: Apache
rpm_group: Development/Languages/Python
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: ioc_writer-0.3.3-1.el8.src.rpm
checksum_type: sha256
description:
  ioc\_writer
  ===========

  The source code in this package is made available under the terms of the
  Apache License , Version 2.0. See the "LICENSE " file for more
  information.

  Status
  ------

  -  |Build Status|
  -  |Coverage Status|

  Author
  ------

  William Gibb william.gibb at fireeye dot com

  Purpose
  -------

  Provide a python library that allows for basic creation and editing of
  OpenIOC objects. It supports a basic CRUD (Create, Read, Update, Delete)
  for various items:

  +-----------------------+----------+--------+----------+----------+
  | item                  | Create   | Read   | Update   | Delete   |
  +=======================+==========+========+==========+==========+
  | IOC name              | Yes      | No     | Yes      | Yes      |
  +-----------------------+----------+--------+----------+----------+
  | IOC description       | Yes      | No     | Yes      | Yes      |
  +-----------------------+----------+--------+----------+----------+
  | created date          | Yes      | No     | Yes      | N/A      |
  +-----------------------+----------+--------+----------+----------+
  | last modified date    | Yes      | No     | Yes      | N/A      |
  +-----------------------+----------+--------+----------+----------+
  | published date        | Yes      | No     | Yes      | N/A      |
  +-----------------------+----------+--------+----------+----------+
  | link metadata         | Yes      | No     | Yes      | Yes      |
  +-----------------------+----------+--------+----------+----------+
  | IndicatorItem nodes   | Yes      | No     | NotYet   | Yes      |
  +-----------------------+----------+--------+----------+----------+
  | Indicator nodes       | Yes      | No     | NotYet   | Yes      |
  +-----------------------+----------+--------+----------+----------+
  | Parameters            | Yes      | No     | Yes      | Yes      |
  +-----------------------+----------+--------+----------+----------+

  Items do not have built in Read operations, since all items can be
  accesed with built in ElementTree syntax or the use of XPATH to select
  portions of the IOC.

  No decision has been made about whether or not to support changing of
  existing Indicator/IndicatorItem nodes.

  See the Docs located at https://pythonhosted.org/ioc\_writer/ and the
  examples directory for examples of working with the library. The user
  code should avoid having to call functionality in ioc\_writer.ioc\_et.

  Requirements
  ------------

  The python "lxml" library must be installed. This can be obtained from
  https://pypi.python.org/pypi/lxml

  Installation
  ------------

  See the file named "INSTALL" for instructions on installing this library
  locally.

  Examples
  --------

  Example code lives in the examples folder of the repository.

  1. examples/11\_to\_10\_downgrade Script to downgrade OpenIOC 1.1 to
     OpenIOC 1.1.
  2. examples/openioc\_to\_yara Scripts that support encapsulating YARA
     signatures in OpenIOC 1.1 format.
  3. examples/simple\_ioc\_writer Script that consumes a csv of data to
     build an IOC. this csv contains the content, context, et cetera. An
     example CSV is provided.

  Bug reports / questions / feedback / feature requests
  =====================================================

  william.gibb at fireeye dot com

  .. |Build Status| image:: https://travis-ci.org/mandiant/ioc_writer.svg?branch=master
     :target: https://travis-ci.org/mandiant/ioc_writer
  .. |Coverage Status| image:: https://coveralls.io/repos/github/mandiant/ioc_writer/badge.svg?branch=master
     :target: https://coveralls.io/github/mandiant/ioc_writer?branch=master


pkgId: 29ae71c83bf836caa26bdfd8047856bd3bda83b6657185748aa268a734e0a727
name: jafat
arch: src
version: 1.1.6
epoch: 0
release: 2.el8
summary: JAFAT is an assortment of tools to assist in the forensic investigation of computer systems.
url: http://jafat.sourceforge.net
rpm_license: GPLv2+
rpm_group: Applications/File
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: jafat-1.1.6-2.el8.src.rpm
checksum_type: sha256
description:
  JAFAT is an assortment of tools to assist in the forensic investigation of computer systems, the included tools are:
  - cookie_cruncher.pl
  - dumpster_dive.pl
  - lnk-parse.pl
  - UserAssist.pl
  - Safari Forensic Tools suite


pkgId: e02d8fe083bafe4a30aa30202d636ce08596af85fea91fee9176e9d9399e73bf
name: libewf
arch: src
version: 20160718
epoch: 0
release: 20140806.4.el8
summary: Library to support the Expert Witness Compression Format (EWF)
url: https://github.com/libyal/libewf/wiki
rpm_license: LGPL
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: libewf-20160718-20140806.4.el8.src.rpm
checksum_type: sha256
description:
  libewf is a library to support the Expert Witness Compression Format (EWF).
  libewf allows you to read media information of EWF files in the SMART (EWF-S01)
  format and the EnCase (EWF-E01) format. libewf allows to read files created by
  EnCase 1 to 6, linen and FTK Imager.


pkgId: 34174a06e17d2fe69f991ece473b96a04e0eef505d44db9eda64807bfab73c09
name: libfixbuf
arch: src
version: 2.4.1
epoch: 0
release: 1.el8
summary: Fixbuf IPFIX implementation library
url: http://tools.netsa.cert.org/fixbuf/
rpm_license: LGPLv3
rpm_vendor: http://tools.netsa.cert.org/
rpm_group: Applications/System
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: libfixbuf-2.4.1-1.el8.src.rpm
checksum_type: sha256
description:
  libfixbuf aims to be a compliant implementation of the IPFIX Protocol
  and message format, from which IPFIX Collecting Processes and
  IPFIX Exporting Processes may be built.


pkgId: b2442365eaa347a1abed123410b52f6c3660ebadc3e0412ce9dd5b0f1dee4763
name: libiconv
arch: src
version: 1.15
epoch: 0
release: 1.el8
summary: Character set conversion library
url: https://www.gnu.org/software/libiconv/
rpm_license: LGPL v2+
rpm_group: Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: libiconv-1.15-1.el8.src.rpm
checksum_type: sha256
description:
  This library provides an iconv() implementation, for use on systems
  which don't have one, or whose implementation cannot convert from/to
  Unicode.


pkgId: 348c1a526e68ab73289c7b69039eeb3b20ab94f455cf7906714f9289b4e872a7
name: libpff
arch: src
version: 20180714
epoch: 0
release: 5.el8
url: https://github.com/libyal/libpff/wiki
rpm_license: LGPL
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: libpff-20180714-5.el8.src.rpm
checksum_type: sha256
summary:
  Library to to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format. PFF is used in PAB (Personal Address Book), PST (Personal Storage Table) and OST (Offline Storage Table) files.

description:
  libpff is a library to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format. PFF is used in PAB (Personal Address Book), PST (Personal Storage Table) and OST (Offline Storage Table) files.


pkgId: 0ca8ae034854d38a133688a6b90b638fa3431f5be74be855f15747bd8f1c46a7
name: libpst
arch: src
version: 0.6.72
epoch: 0
release: 4.el8
summary: Utilities to convert Outlook .pst files to other formats
url: http://www.five-ten-sg.com/libpst/
rpm_license: GPLv2+
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: libpst-0.6.72-4.el8.src.rpm
checksum_type: sha256
description:
  The Libpst utilities include readpst which can convert email messages
  to both mbox and MH mailbox formats, pst2ldif which can convert the
  contacts to .ldif format for import into ldap databases, and pst2dii
  which can convert email messages to the DII load file format used by
  Summation.


pkgId: 65811c663748840b7b12cdfc6df6efb381d881153f5623a8e295d6ded20d1889
name: libsmraw
arch: src
version: 20210807
epoch: 0
release: 1.el8
summary: Library to access the storage media (SM) (split) RAW format
url: https://github.com/libyal/libsmraw/wiki
rpm_license: LGPL
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: libsmraw-20210807-1.el8.src.rpm
checksum_type: sha256
description:
  libsmraw is library to access the storage media (SM) (split) RAW format
  The library supports both RAW and split RAW.


pkgId: 054b0a55e2fd639e637cbee1a168d13fc87e4a45814a7f6cda92bac63b4ae4f7
name: libtomcrypt
arch: src
version: 1.18.2
epoch: 0
release: 3.el8
summary: A comprehensive, portable cryptographic toolkit
url: http://www.libtom.net/
rpm_license: Public Domain or WTFPL
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: libtomcrypt-1.18.2-3.el8.src.rpm
checksum_type: sha256
description:
  A comprehensive, modular and portable cryptographic toolkit that provides
  developers with a vast array of well known published block ciphers, one-way hash
  functions, chaining modes, pseudo-random number generators, public key
  cryptography and a plethora of other routines.

  Designed from the ground up to be very simple to use. It has a modular and
  standard API that allows new ciphers, hashes and PRNGs to be added or removed
  without change to the overall end application. It features easy to use functions
  and a complete user manual which has many source snippet examples.


pkgId: 1c813f3290ef515a1e6cda7276f0074865bb6bfed92477ce0aa386f9a90f06fc
name: libtommath
arch: src
version: 1.2.0
epoch: 0
release: 1.el8
summary: A portable number theoretic multiple-precision integer library
url: http://www.libtom.net/
rpm_license: Public Domain
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: libtommath-1.2.0-1.el8.src.rpm
checksum_type: sha256
description:
  A free open source portable number theoretic multiple-precision integer library
  written entirely in C. (phew!). The library is designed to provide a simple to
  work with API that provides fairly efficient routines that build out of the box
  without configuration.


pkgId: 0d12af546d19edb8148c9a6a54607181056351f4f9ccb9f472ae80ad79c7e875
name: lime-kernel-modules-el9-x86_64
arch: src
version: 1.9.1
epoch: 0
release: 14
description: This package provides kernel objects for CentOS 9 Stream x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-9-stream-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-el9-x86_64-1.9.1-14.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for CentOS 9 Stream x86_64 for LiME


pkgId: bc93061578bf70f7b2572781f7465a6ed4507d75ac1ff5862a8edbe551038d99
name: lime-kernel-modules-fc17-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 2
description: This package provides kernel objects for Fedora 17 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: fedora-17-x86-64
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc17-x86_64-1.1.r17-2.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 17 x86_64 for LiME


pkgId: 10672a1e2c1d72515e9b4ec3c0a7d56627d7af202b3967c20e9a0ac29fd63e7a
name: lime-kernel-modules-fc18-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 2
description: This package provides kernel objects for Fedora 18 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-18-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc18-x86_64-1.1.r17-2.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 18 x86_64 for LiME


pkgId: 99702ec311d1bf8152cc1f9569925fe26a1c4a4c769a1a7e5634649d28f77981
name: lime-kernel-modules-fc21-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 29
description: This package provides kernel objects for Fedora 21 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-21-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc21-x86_64-1.1.r17-29.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 21 x86_64 for LiME


pkgId: 1c38a71cec35bd8b653d904d60647289862bb33ea444947447a49bb7f6210253
name: lime-kernel-modules-fc22-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 36
description: This package provides kernel objects for Fedora 22 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-22-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc22-x86_64-1.1.r17-36.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 22 x86_64 for LiME


pkgId: 27df8a96a1f1e124d3c85b32bcd99d2f61a119182ec1a6074e8bcc9372455a7c
name: lime-kernel-modules-fc24-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 47
description: This package provides kernel objects for Fedora 22 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-24-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc24-x86_64-1.1.r17-47.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 24 x86_64 for LiME


pkgId: 08086d48ce927ae133b21afca29af66bd574fddc8d70963fddb227cfed71b8de
name: lime-kernel-modules-fc25-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 50
description: This package provides kernel objects for Fedora 22 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-25-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc25-x86_64-1.1.r17-50.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 25 x86_64 for LiME


pkgId: 8f20223df1c0b938c3709939faee3ea192cbb8ada6ce8da1c00fd998042fcc15
name: lime-kernel-modules-fc26-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 38
description: This package provides kernel objects for Fedora 26 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-26-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc26-x86_64-1.1.r17-38.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 26 x86_64 for LiME


pkgId: bc7811d7cf96587afe3c2c5eafbee818817d46cf0da2c793b28451860bc5dc55
name: lime-kernel-modules-fc27-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 44
description: This package provides kernel objects for Fedora 22 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-27-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc27-x86_64-1.1.r17-44.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 27 x86_64 for LiME


pkgId: 805dfe72548c73368af720bcb1e683c75761f5b9d8df5dc3604a1cabbe9e221a
name: lime-kernel-modules-fc28-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 42
description: This package provides kernel objects for Fedora 28 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-28-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc28-x86_64-1.1.r17-42.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 28 x86_64 for LiME


pkgId: 4a65b4b5ec03a3ecc9972d4789bfd29d73550b517eb575f040281f9aae520f11
name: lime-kernel-modules-fc29-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 37
description: This package provides kernel objects for Fedora 29 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-29-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc29-x86_64-1.1.r17-37.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 29 x86_64 for LiME


pkgId: 2eed86b461fbce19096d16669f866c63544f93541e1fc13bf890a0531ec95ce1
name: lime-kernel-modules-fc30-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 39
description: This package provides kernel objects for Fedora 30 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-30-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc30-x86_64-1.1.r17-39.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 30 x86_64 for LiME


pkgId: ef159759f28269e103a5c8fffe3224f8696ae9061ea8ef12f3f6c91b7df3d117
name: lime-kernel-modules-fc31-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 40
description: This package provides kernel objects for Fedora 31 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-31-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc31-x86_64-1.1.r17-40.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 31 x86_64 for LiME


pkgId: c6c8e9842de7672fbb8c21aaec8531afba015c8d163989277d86cdc7dff517be
name: lime-kernel-modules-fc32-x86_64
arch: src
version: 1.9.1
epoch: 0
release: 46
description: This package provides kernel objects for Fedora 32 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-32-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc32-x86_64-1.9.1-46.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 32 x86_64 for LiME


pkgId: ed22e1087c0dbf75253068119156ddfb9289a22bb73f0aae873e6fb588963eaa
name: lime-kernel-modules-fc33-x86_64
arch: src
version: 1.9.1
epoch: 0
release: 46
description: This package provides kernel objects for Fedora 33 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-33-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc33-x86_64-1.9.1-46.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 33 x86_64 for LiME


pkgId: e9b495e7111481bb71d5f3a1b98d62eb3a2db70a6db6e695075570803d7f7a7f
name: lime-kernel-modules-fc34-x86_64
arch: src
version: 1.9.1
epoch: 0
release: 51
description: This package provides kernel objects for Fedora 34 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-34-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc34-x86_64-1.9.1-51.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 34 x86_64 for LiME


pkgId: a44dccad7cfb0fd273a4424db7637eccde11ce685cc23c6906198d03b2cc7bba
name: lime-kernel-modules-fc35-x86_64
arch: src
version: 1.9.1
epoch: 0
release: 41
description: This package provides kernel objects for Fedora 35 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-35-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc35-x86_64-1.9.1-41.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 35 x86_64 for LiME


pkgId: 8bf52131af2c0f2e63f6a39287c6fb0b33f7ad79c52cb20d889078a12951da75
name: lime-kernel-modules-fc36-x86_64
arch: src
version: 1.9.1
epoch: 0
release: 17
description: This package provides kernel objects for Fedora 36 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-36-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc36-x86_64-1.9.1-17.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 36  x86_64 for LiME


pkgId: ef3d6cf43d929ca92c518c44c93f68994c02d23680c8393405e79247fb35ee1b
name: luajit
arch: src
version: 2.0.4
epoch: 0
release: 3.el8
summary: Just-In-Time Compiler for Lua
url: http://luajit.org/
rpm_license: MIT
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: luajit-2.0.4-3.el8.src.rpm
checksum_type: sha256
description:
  LuaJIT implements the full set of language features defined by Lua 5.1.
  The virtual machine (VM) is API- and ABI-compatible to the standard
  Lua interpreter and can be deployed as a drop-in replacement.


pkgId: 1b860b9cf8d18f38a59efbd38c7fcde1085e30d5efede5c4fa537274d3f39747
name: mac_apt
arch: src
version: 1.4.3.dev
epoch: 0
release: 3.el8
summary: Mac OS Artifact Parsing Tool
url: https://github.com/ydkhatri/mac_apt/wiki
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: mac_apt-1.4.3.dev-3.el8.src.rpm
checksum_type: sha256
description:
  mac_apt is a DFIR (Digital Forensics and Incident Response) tool to process Mac computer full disk images (or live machines) and extract
  data/metadata useful for forensic investigation. It is a python based framework, which has plugins to process individual artifacts (such as Safari
  internet history, Network interfaces, Recently accessed files & volumes, ..)

  mac_apt now also includes ios_apt, for processing ios images.

  Requirements: Python 3.7 or above (32/64 bit)

  Features

  * Cross platform (no dependency on pyobjc)
  * Works on E01, VMDK, AFF4, DD, split-DD, DMG (no compression), SPARSEIMAGE & mounted images
  * XLSX, CSV, TSV, Sqlite outputs
  * Analyzed files/artifacts are exported for later review
  * zlib, lzvn, lzfse compressed files are supported!
  * Native HFS & APFS parser
  * Reads the Spotlight database and Unified Logging (tracev3) files

  Latest
  *  Can read Axiom created targeted collection zip files
  *  ios_apt can read GrayKey extracted file system
  *  Can read RECON created .sparseimage files
  *  Support for macOS Big Sur Sealed volumes (11.0)
  *  Introducing ios_apt for processing iOS/ipadOS images
  *  FAST mode
  *  Encrypted APFS images can now be processed using password/recovery-key
  *  macOS Catalina (10.15+) separately mounted SYSTEM & DATA volumes now supported
  *  AFF4 images (including macquisition created) are supported


pkgId: 4084bb5762db0adc5529591afe9ffde440282775506aba5ca4232630075b1c39
name: maryam
arch: src
version: 2.2.6.post1
epoch: 0
release: 1.el8
summary: OWASP Maryam is a modular/optional open source framework based on OSINT and data gathering
url: https://github.com/saeeddhqan/Maryam
rpm_license: GPL-V3
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: maryam-2.2.6.post1-1.el8.src.rpm
checksum_type: sha256
description:
  [![Build Status]( ![Version 2.2.6]( ![GPLv3 License]( ![Python 3.8.x](
  [![Codacy Badge]( [![CII Best Practices](


pkgId: 036ea9b58bad123b3ec099001b10f9b902a0f5aee2541aff5a0c19ea7131acbc
name: missidentify
arch: src
version: 1.0
epoch: 0
release: 1.el8
summary: Find Win32 applications
url: http://missidentify.sourceforge.net/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: missidentify-1.0-1.el8.src.rpm
checksum_type: sha256
description:
  Miss Identify is a program to find Win32 applications. In its default
  mode it displays the filename of any executable that does not have
  an executable extension (i.e. exe, dll, com, sys, cpl, hxs, hxi, olb,
  rll, or tlb). The program can also be run to display all executables
  encountered, regardless of the extension. This is handy when looking
  for all of the executables on a drive. Other options allow the user to
  record the strings found in an executable and to work recursively. See
  the manual page for more information.
  Sample output

  Searching for mislabeled executables

  C:\> missidentify *
  C:\missidentify-1.0\sample.jpg

  Searching for all executables

  C:\> missidentify -a *
  C:\missidentify-1.0\sample.jpg
  C:\missidentify-1.0\missidentify.exe

  Searching for all executables in an unusual place

  C:\> missidentify -ar c:\windows\system32
  ...
  C:\WINDOWS\System32\ntdll.dll
  C:\WINDOWS\System32\ntoskrnl.exe
  C:\WINDOWS\System32\NEVER-GONNA-CATCH-ME.EXE
  C:\WINDOWS\System32\ntver.dll


pkgId: 2e7473bceadf2ec9237799bc6df44f4334c0eb154e3eb1fe6fe05fa831bddd13
name: mtftar
arch: src
version: 0.9.0
epoch: 0
release: 1.el8
summary: Translate an MTF stream to a TAR stream
url: https://github.com/geocar/mtftar
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: mtftar-0.9.0-1.el8.src.rpm
checksum_type: sha256
description:
  mtftar is a tool for translating a MTF stream to a TAR stream.

  MTF is a format commonly found on Microsoft systems as it's what is generated
  by the NTBACKUP.EXE tool that ships with all modern versions of Windows.

  Usage: mtftar [-v] [-p] [-s setno] [patterns...] < backup.btf | tar xvf -
         mtftar [-v] [-p] [-s setno] -f backup.btf [patterns...] | tar xvf -
         mtftar [-v] [-p] [-s setno] -f backup.btf -o output.tar [patterns...]
         mtftar [-v] [-p] [-s setno] -o output.tar [patterns...] < backup.btf
         mtftar -l [-v] [-s setno] < backup.btf
         mtftar -l [-v] [-s setno] -f backup.btf
         mtftar -L [-v] [-s setno] < backup.btf
         mtftar -L [-v] [-s setno] -f backup.btf

  mtftar is most often used as a filter, as in:

  	mtftar < MyBackup.bkf | tar xvf -

  mtftar can read Incremental, Differential, Copy, and Normal backups, but it
  does not understand them. If you are using these backup modes in separate
  bkf files, you should be careful to order your extractions.

  mtftar _should_ be able to read directly from the TAPE drive on Linux, and
  possibly other systems as well.

  mtftar can pre-filter the input stream as well as patch the pathnames
  on-the-fly. this is done with the -p option which "strips" what is matched
  as prefix on the patterns.

  mtftar does NOT understand the ACL streams, although patches would be accepted
  that translated these into the POSIX ACL extensions for the TAR format.


  parts of mtftar, and most of the best-knowledge on the bkf file format, and MTF
  in general comes from a hard-to-find program called "mtf" which I cannot find
  again, but seems to be written by a D. Alan Stewart. "mtf" crashed an awful
  lot, and generated bogus output frequently, but nevertheless, was invaluable
  in building mtftar. "mtf" was released under the GNU Public License version 2
  or any later version.


pkgId: 565691fb63fcdd17faa69f4ebdc479f6cb627d9d76117df277098114a02d1235
name: musl
arch: src
version: 1.2.1
epoch: 0
release: 1.el8
summary: Fully featured lightweight standard C library for Linux
url: https://musl.libc.org
rpm_license: MIT
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: musl-1.2.1-1.el8.src.rpm
checksum_type: sha256
description:
  musl is a C standard library to power a new generation
  of Linux-based devices. It is lightweight, fast, simple,
  free, and strives to be correct in the sense of standards
  conformance and safety.


pkgId: 7382d5b0cfe0fa4f14f4c0259a536cf59de39167ba3078c607e157518b6fe433
name: netsa-python
arch: src
version: 1.5
epoch: 0
release: 1.el8
summary: Python routines and frameworks helpful when developing analyses using the SiLK toolkit
url: http://tools.netsa.cert.org/netsa-python/index.html
rpm_license: GPLv2
rpm_vendor: CERT Network Situational Awareness
rpm_group: Applications/System
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: netsa-python-1.5-1.el8.src.rpm
checksum_type: sha256
description:
  The netsa-python library is a grab-bag of Python routines and frameworks
  that the NetSA team at CERT has found helpful when developing analyses using the SiLK
  toolkit. Of particular note are the netsa.script NetSA Scripting
  Framework, which provides a standard framework for writing scripts that
  process flow data, and the netsa.util.shell command line processing
  system, which provides tools for managing extremely complicated
  collections of shell processes that should fail or succeed together
  (extremely useful when working with named pipes).

  netsa-python is compatible with Python versions 2.4 and greater.

  Here are the tools installed:

  	netsa.script — The NetSA Scripting Framework
  	netsa.sql — SQL Database Access
  	netsa.util.shell — Robust Shell Pipelines

  	Data Manipulation
  		netsa.data.countries — Country and Region Codes
  		netsa.data.format — Formatting Data for Output
  		netsa.data.nice — “Nice” Numbers for Chart Bounds
  		netsa.data.times — Time and Date Manipulation

  	Miscellaneous Facilities
  		netsa.files — File and Path Manipulation
  		netsa.files.datefiles — Date-based filenames
  		netsa.json — JSON Wrapper Module
  		netsa.tools.service — Tools for building services
  		netsa.util.clitest — Utility for testing CLI tools
  		netsa.util.compat — Python version compatibility code


pkgId: 344aa3666a209b876ca2e84b82e48b76512b550945026d199c08ecef84ddac6e
name: netsa-rayon
arch: src
version: 1.4.3
epoch: 0
release: 2.el8
summary: Python library and set of tools for generating basic two-dimensional statistical visualizations
url: http://tools.netsa.cert.org/rayon/index.html
rpm_license: GPL
rpm_group: Development/Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: netsa-rayon-1.4.3-2.el8.src.rpm
checksum_type: sha256
description:
  Rayon is a Python library and set of tools for generating basic
  two-dimensional statistical visualizations. Rayon can be used to
  automate reporting; provide data visualization in command-line, GUI or
  web applications; or do ad-hoc exploratory data analysis.


pkgId: 2b731c1d28ec34a8e63f440f20bdbc204d4e2eb31b6e7f58348dbb657afda283
name: ntfs-3g
arch: src
version: 2021.8.22
epoch: 2
release: 2.el8
summary: Linux NTFS userspace driver
url: https://www.tuxera.com/company/open-source/
rpm_license: GPLv2+
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: ntfs-3g-2021.8.22-2.el8.src.rpm
checksum_type: sha256
description:
  NTFS-3G is a stable, open source, GPL licensed, POSIX, read/write NTFS
  driver for Linux and many other operating systems. It provides safe
  handling of the Windows XP, Windows Server 2003, Windows 2000, Windows
  Vista, Windows Server 2008 and Windows 7 NTFS file systems. NTFS-3G can
  create, remove, rename, move files, directories, hard links, and streams;
  it can read and write normal and transparently compressed files, including
  streams and sparse files; it can handle special files like symbolic links,
  devices, and FIFOs, ACL, extended attributes; moreover it provides full
  file access right and ownership support.


pkgId: b9647111aa2cc8cb8c8e9901b818ebf36b48c9c802b2aadd69975eb274edb219
name: openpgm
arch: src
version: 5.2.122
epoch: 0
release: 16.el8
summary: An implementation of the PGM reliable multicast protocol
url: http://openpgm.googlecode.com/
rpm_license: LGPLv2
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: openpgm-5.2.122-16.el8.src.rpm
checksum_type: sha256
description:
  OpenPGM is an open source implementation of the Pragmatic General
  Multicast (PGM) specification in RFC 3208.


pkgId: 743ed4e9e604b22bc46361339aca63ce2935af5be2bd39d00d5c2fd269eb01d7
name: packetexaminer
arch: src
version: 0.9
epoch: 0
release: 4.el8
summary: PacketExaminer - Analyze PCAP files
url: https://github.com/joemcmanus/packetexaminer
rpm_license: GPL3
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: packetexaminer-0.9-4.el8.src.rpm
checksum_type: sha256
description:
  This is a harness to perform PCAP analysis that a security engineer may do during an incident response
  or when looking at network security. I - Joe McManus - found myself using a collection of tools and techniques
  again and again and thought it would be helpful to create a program that would do this for me. This hopefully
  automates some routine functions you would do manually.


pkgId: 7e59825fb70def5ed2aed90300ea8bc9c650e40385a76ae466240afb5c08d16b
name: pasco
arch: src
version: 1.0
epoch: 0
release: 1.el8
summary: Reconstruct IE internet activity
url: http://sourceforge.net/projects/odessa/files/Pasco/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: pasco-1.0-1.el8.src.rpm
checksum_type: sha256
description:
  Pasco will parse the information in an index.dat file and output the
  results in a field delimited manner so that it may be imported into
  your favorite spreadsheet program. Pasco is built to work on multiple
  platforms and will execute on Windows (through Cygwin), Mac OS X, Linux,
  and *BSD platforms.


pkgId: 496f775b4fa5504ff4848a49a6b82d45b22e1d89fa77be2d39ba6b6c393287a2
name: pefile
arch: src
version: 2021.9.3
epoch: 0
release: 1.el8
summary: Python module for working with Portable Executable files
url: https://github.com/erocarrera/pefile
rpm_license: MIT
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: pefile-2021.9.3-1.el8.src.rpm
checksum_type: sha256
description:
  pefile is a multi-platform Python module to read and work with Portable
  Executable (aka PE) files. Most of the information in the PE Header is
  accessible, as well as all the sections, section's information and data.
  pefile requires some basic understanding of the layout of a PE file. Armed
  with it it's possible to explore nearly every single feature of the file.
  Some of the tasks that pefile makes possible are:
  * Modifying and writing back to the PE image
  * Header Inspection
  * Sections analysis
  * Retrieving data
  * Warnings for suspicious and malformed values
  * Packer detection with PEiD’s signatures
  * PEiD signature generation


pkgId: bfea5580c18a2e28a13f1694b2143864eac2ee30f7716d4702d31236ae4c867f
name: perl-DateTime-Format-WindowsFileTime
arch: src
version: 0.02
epoch: 0
release: 1.el8
summary: Make a nice DateTime object from the "Windows File Time" hex string
url: http://search.cpan.org/dist/DateTime-Format-WindowsFileTime/
rpm_license: CHECK(GPL+ or Artistic)
rpm_group: Development/Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: perl-DateTime-Format-WindowsFileTime-0.02-1.el8.src.rpm
checksum_type: sha256
description:
  Converts a Windows FILETIME into a DateTime object. The Windows FILETIME
  structure holds a date and time associated with a file. The structure
  identifies a 64-bit integer specifying the number of 100-nanosecond
  intervals which have passed since January 1, 1601.


pkgId: be0ce603457136ba004c83cdaf825284239f37433598979e84ef19ef96ea83c7
name: perl-Parse-Win32Registry
arch: src
version: 1.0
epoch: 0
release: 3.el8
summary: Parse Windows Registry Files
url: http://search.cpan.org/dist/Parse-Win32Registry/
rpm_license: CHECK(GPL+ or Artistic)
rpm_group: Development/Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: perl-Parse-Win32Registry-1.0-3.el8.src.rpm
checksum_type: sha256
description:
  Parse::Win32Registry is a module for parsing Windows Registry files,
  allowing you to read the keys and values of a registry file without going
  through the Windows API.


pkgId: 4b7bcd9a254f24f5ed8940f026758995e84aea3f98f346db5f6144b9ad4398dd
name: plaso
arch: src
version: 20220724
epoch: 0
release: 1.el8
url: http://plaso.kiddaland.net/
rpm_license: Apache License, Version 2.0
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: plaso-20220724-1.el8.src.rpm
checksum_type: sha256
summary:
  plaso - Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines

description:
  Plaso (plaso langar að safna öllu) is the Python based back-end engine
  used by tools such as log2timeline for automatic creation of a super
  timelines. The goal of log2timeline (and thus plaso) is to provide a
  single tool that can parse various log files and forensic artifacts from
  computers and related systems, such as network equipment to produce a
  single correlated timeline. This timeline can then be easily analysed by
  forensic investigators/analysts, speeding up investigations by correlating
  the vast amount of information found on an average computer system.

  Auxiliary goal of plaso is to provide forensic analysts and tool makers
  powerful libraries that they can use to access, find, read and parse
  various files within disk images to create their own tools, or to adjust
  log2timeline to their own workflow, instead of relying on the workflow
  provided by log2timeline.py.


  This version uses a Python Virtual Environment to make use of Python 3.8.


pkgId: 885c8172dff10522830649194af35153dbef005fd7789be2a1c2869d91fbbccf
name: prism
arch: src
version: 1.2
epoch: 0
release: 9.el8
summary: Visualize flow data as a time-series broken down into several configurable bins
url: http://tools.netsa.cert.org/script-prism/index.html
rpm_license: GPLv2
rpm_vendor: CERT Network Situational Awareness
rpm_group: Applications/System
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: prism-1.2-9.el8.src.rpm
checksum_type: sha256
description:
  The Prism trend script is a tool for quickly visualizing flow data as a time-series broken
  down into several configurable bins by SiLK's rwfilter tool. The script can be used directly,
  or might be used as a component in other more specialized scripts.

  In addition to providing immediate visualizations, the Prism trend script can store these
  breakdowns in a relational database (currently supporting PostgreSQL or sqlite) for later
  quick lookup.

  Prism 1.1 requires netsa-python 1.3, Rayon 1.3.0, and SiLK 2.0.0 or better.

  For assistance with the Prism script, please contact netse-help@cert.org


pkgId: 36ba26bde58ca24b2dbf7ca8458097da804d28646c8dac0046d10dc5f9b44873
name: protobuf-c
arch: src
version: 1.3.0
epoch: 0
release: 1.el8
summary: C bindings for Google's Protocol Buffers
url: http://code.google.com/p/protobuf-c/
rpm_license: ASL 2.0
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: protobuf-c-1.3.0-1.el8.src.rpm
checksum_type: sha256
description:
  Protocol Buffers are a way of encoding structured data in an efficient yet
  extensible format. This package provides a code generator and run-time
  libraries to use Protocol Buffers from pure C (not C++).

  It uses a modified version of protoc called protoc-c.


pkgId: fea8c7802f83ad56a2aebb4b4ecc46327930461ed57702c80ef7cb874f3c743b
name: pstotext
arch: src
version: 1.9
epoch: 0
release: 2.1.el8
summary: PostScript to text converter
url: http://pages.cs.wisc.edu/~ghost/doc/pstotext.htm
rpm_license: Digital's paranoid but open-source license
rpm_group: Applications/Text
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: pstotext-1.9-2.1.el8.src.rpm
checksum_type: sha256
description:
  This utility reads in postscript files and outputs an ASCII rendering.
  While the rendering is not always accurate, it is often sufficient.


pkgId: 2ae8419cb48c642a9470e51ef72c4eb7ee1676a77931bb5618bf6b742b707b2c
name: pycoin
arch: src
version: 0.77
epoch: 0
release: 0.el8
summary: Utilities for Bitcoin and altcoin addresses and transaction manipulation
url: https://github.com/richardkiss/pycoin
rpm_license: MIT
rpm_group: Development/Languages/Python
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: pycoin-0.77-0.el8.src.rpm
checksum_type: sha256
description:
  Many of the names of data structures in bitcoin, like "script pubkey",
  are derived from names that came from the original C++ source code (known
  here as the “satoshi client”). Often times, it appears these names
  were chosen out of expediency, and frequently they are overly generic
  which makes it difficult to understand or remember what they are for.

  With the benefit of time and a lack of legacy users, pycoin has had the
  luxury to come up with alternative names for many of these structures
  that more clearly suggest their actual use. We will use the pycoin names
  for these structures in this documentation, but will also make mention
  of the “official” names used by the satoshi client.


pkgId: 257b66e14125ed651934bf3d6664e4832aa7ac04d2a4ca843dfd8e611f4af76c
name: pycparser
arch: src
version: 2.21
epoch: 0
release: 1.el8
summary: C parser and AST generator written in Python
url: http://github.com/eliben/pycparser
rpm_license: BSD
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: pycparser-2.21-1.el8.src.rpm
checksum_type: sha256
description:
  pycparser is a complete parser for the C language, written in pure Python.
  It is a module designed to be easily integrated into applications that
  need to parse C source code.


pkgId: 580c0ce5337b315b2b8965f4e76a8fdaa9e60c042a500a512242d6eadab871a5
name: pyfixbuf
arch: src
version: 0.9.0
epoch: 0
release: 1.el8
summary: Python API for libfixbuf
url: https://tools.netsa.cert.org/pyfixbuf/doc/index.html
rpm_license: GPLv2
rpm_vendor: CERT Network Situational Awareness
rpm_group: Applications/System
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: pyfixbuf-0.9.0-1.el8.src.rpm
checksum_type: sha256
description:
  pyfixbuf is a Python API for libfixbuf, an implementation of the IPFIX
  protocol used for building collecting and exporting processes. pyfixbuf
  can be used to write applications, often called mediators, that collect and
  export IPFIX. Mediators are useful in modifying, filtering, or adding to the
  contents of a message before forwarding to another IPFIX collection point,
  or converting IPFIX to another format (text, database, JSON, etc.).


pkgId: 44d0eca22d002e6b5ca419326c13018a9debfae3f2068789f1f260abe3fabc78
name: pyparsing
arch: src
version: 3.0.9
epoch: 0
release: 1.el8
summary: An object-oriented approach to text processing
url: http://pyparsing.wikispaces.com/
rpm_license: MIT
rpm_group: Development/Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: pyparsing-3.0.9-1.el8.src.rpm
checksum_type: sha256
description:
  pyparsing is a module that can be used to easily and directly configure syntax
  definitions for any number of text parsing applications.


pkgId: 75364a92cf32bd2c53773ab728189870ba2dc43e172b20387696d2c1b4e0486c
name: python-colorama
arch: src
version: 0.4.1
epoch: 0
release: 2.el8
summary: Cross-platform colored terminal text
url: http://pypi.python.org/pypi/colorama
rpm_license: BSD
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: python-colorama-0.4.1-2.el8.src.rpm
checksum_type: sha256
description:
  Makes ANSI escape character sequences, for producing colored
  terminal text and cursor positioning, work under MS Windows.

  ANSI escape character sequences have long been used to produce colored terminal
  text and cursor positioning on Unix and Macs. Colorama makes this work on
  Windows, too.
  It also provides some shortcuts to help generate ANSI sequences, and works fine
  in conjunction with any other ANSI sequence generation library, such as
  Termcolor.


pkgId: b7d56d322287bbc1440b50983c9033a840f0a667057e0438ecc30c77ad32a59f
name: python-crypto
arch: src
version: 2.6.1
epoch: 0
release: 28.1.el8
summary: Cryptography library for Python
url: http://www.pycrypto.org/
rpm_license: Public Domain and Python
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: python-crypto-2.6.1-28.1.el8.src.rpm
checksum_type: sha256
description:
  PyCrypto is a collection of both secure hash functions (such as MD5 and
  SHA), and various encryption algorithms (AES, DES, RSA, ElGamal, etc.).


pkgId: 2cda3608838ddcf27d951111010bc1099549142facd535d3f53ab9539741abfd
name: python-oletools
arch: src
version: 0.60.1
epoch: 0
release: 1.el8
summary: Tools to analyze Microsoft OLE2 files
url: https://www.decalage.info/python/oletools
rpm_license: BSD and MIT and Python
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: python-oletools-0.60.1-1.el8.src.rpm
checksum_type: sha256
description:
  The python-oletools is a package of python tools from Philippe Lagadec
  to analyze Microsoft OLE2 files (also called Structured Storage,
  Compound File Binary Format or Compound Document File Format),
  such as Microsoft Office documents or Outlook messages, mainly for
  malware analysis, forensics and debugging.
  It is based on the olefile parser.
  See http://www.decalage.info/python/oletools for more info.


pkgId: b3c1b6bde2c6b684f738aa3557d22b4af017355136a73efdfef962e0894d279b
name: python-ply
arch: src
version: 3.11
epoch: 0
release: 2.el8
summary: Python Lex-Yacc
url: http://www.dabeaz.com/ply/
rpm_license: BSD
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: python-ply-3.11-2.el8.src.rpm
checksum_type: sha256
description:
  PLY is a straightforward lex/yacc implementation. Here is a list of its
  essential features:
  * It is implemented entirely in Python.
  * It uses LR-parsing which is reasonably efficient and well suited for larger
    grammars.
  * PLY provides most of the standard lex/yacc features including support
    for empty productions, precedence rules, error recovery, and support
    for ambiguous grammars.
  * PLY is straightforward to use and provides very extensive error checking.
  * PLY doesn't try to do anything more or less than provide the basic lex/yacc
    functionality. In other words, it's not a large parsing framework or a
    component of some larger system.


pkgId: 9a4726419ba2d97f2a363a97034c6354ba7a3a9dce6fb64efbd3702608858f2d
name: python-pysocks
arch: src
version: 1.6.8
epoch: 0
release: 6.el8
summary: A Python SOCKS client module
url: https://github.com/Anorov/PySocks
rpm_license: BSD
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: python-pysocks-1.6.8-6.el8.src.rpm
checksum_type: sha256
description:
  A fork of SocksiPy with bug fixes and extra features.

  Acts as a drop-in replacement to the socket module. Featuring:

  - SOCKS proxy client for Python 2.6 - 3.x
  - TCP and UDP both supported
  - HTTP proxy client included but not supported or recommended (you should use
    urllib2's or requests' own HTTP proxy interface)
  - urllib2 handler included.


pkgId: c62f2c808479c870e4c4b53f074d32f9f1c729e1938e7016a6c75e9af66c27c0
name: python-registry
arch: src
version: 1.2.0
epoch: 0
release: 1.el8
summary: Read access to Windows Registry Files
url: http://www.williballenthin.com/registry/
rpm_license: Apache 2.0
rpm_group: Development/Libraries/Python
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: python-registry-1.2.0-1.el8.src.rpm
checksum_type: sha256
description:
  python-registry was originally written by Willi Ballenthin, a forensicator at Mandiant who wanted to access the contents of the
  Windows Registry from his Linux laptop. python-registry currently provides read-only access to Windows Registry files,
  such as NTUSER.DAT, userdiff, and SAM. The interface is two-fold: a high-level interface suitable for most tasks, and a low level
  set of parsing objects and methods which may be used for advanced study of the Windows Registry. python-registry is written in pure
  Python, making it portable across all major platforms.


pkgId: a1b17a131187f024eaa34c568389b6e333cfa8a18046ec9c5a9e6597422ee8be
name: python-ssdeep
arch: src
version: 3.2
epoch: 0
release: 1.el8
summary: Python wrapper for the ssdeep library
url: http://github.com/DinoTools/python-ssdeep
rpm_license: LGPLv3+
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: python-ssdeep-3.2-1.el8.src.rpm
checksum_type: sha256
description:
  ssdeep Python Wrapper This is a straightforward Python wrapper for ssdeep by
  Jesse Kornblum_, which is a library for computing context triggered piecewise
  hashes (CTPH). Also called fuzzy hashes, CTPH can match inputs that have
  homologies. Such inputs have sequences of identical bytes in the same order,
  although bytes in between these sequences may be different in both content and
  length. :target:


pkgId: 65b7895c0c7fb93c05490a806cbbb953eec713ee63a8d6404ec315389a5a6c16
name: python-yara
arch: src
version: 4.1.3
epoch: 0
release: 1.el8
summary: Python binding for the YARA pattern matching tool
url: http://github.com/VirusTotal/yara-python/
rpm_license: ASL 2.0
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: python-yara-4.1.3-1.el8.src.rpm
checksum_type: sha256
description:
  Python binding for the YARA pattern matching tool.
  YARA is a tool aimed at (but not limited to) helping malware researchers to
  identify and classify malware samples. With YARA you can create descriptions
  of malware families (or whatever you want to describe) based on textual or
  binary patterns. Each description, a.k.a rule, consists of a set of strings
  and a Boolean expression which determine its logic.


pkgId: 4d56e99c1a54ff7e8143923044339c490828fb725a9c7d71fc04ebcbd70dc276
name: python2-typing
arch: src
version: 3.7.4.1
epoch: 0
release: 3.el8
summary: Typing defines a standard notation for type annotations
url: https://pypi.python.org/pypi/typing
rpm_license: Python
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: python2-typing-3.7.4.1-3.el8.src.rpm
checksum_type: sha256
description:
  Typing defines a standard notation for Python function and variable type
  annotations. The notation can be used for documenting code in a concise,
  standard format, and it has been designed to also be used by static and runtime
  type checkers, static analyzers, IDEs and other tools.


pkgId: 8432dd68314f43e9ed7e3a0177799d2870a43ea58c10bafc21d48fbb556dc171
name: pyxattr
arch: src
version: 0.7.2
epoch: 0
release: 2.el8
summary: Extended attributes library wrapper for Python
url: https://pyxattr.k1024.org/
rpm_license: LGPLv2+
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: pyxattr-0.7.2-2.el8.src.rpm
checksum_type: sha256
description:
  Python extension module wrapper for libattr. It allows to query, list,
  add and remove extended attributes from files and directories.


pkgId: 5807134662e401fc7622038cbf7f62dea167e25fc5cdd32d163ac72e3eae232f
name: reglookup
arch: src
version: 1.0.1
epoch: 0
release: 2.el8
summary: Windows NT registry reader/lookup tool
url: http://projects.sentinelchicken.org/reglookup/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: reglookup-1.0.1-2.el8.src.rpm
checksum_type: sha256
description:
  RegLookup project is an small command line utility for reading and
  querying Windows NT/2K/XP registries.

  Currently the program allows one to read an entire registry and output
  it in a (mostly) standardized, quoted format. It also provides features
  for filtering of results based on registry path and data type.


pkgId: f72e0698f8d53909d0fdad3d1cbbbade226db627451d08b644d988ff832a2620
name: regripper
arch: src
version: 30000000
epoch: 0
release: 2.el8
summary: A Windows Registry data extraction and correlation tool
url: https://github.com/keydet89/RegRipper3.0
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: regripper-30000000-2.el8.src.rpm
checksum_type: sha256
description:
  RegRipper is a Windows Registry data extraction and correlation
  tool. RegRipper uses plugins (similar to Nessus) to access specific
  Registry hive files in order to access and extract specific keys, values,
  and data, and does so by bypassing the Win32API.


pkgId: ab4b54ae9ce8d1a10fd0c72d8bcdb444f7e40805ca260d56e610078aa0aa5831
name: rekall-forensics
arch: src
version: 1.7.2.rc1
epoch: 0
release: 1.el8
summary: Advanced forensic and incident response framework
url: http://www.rekall-forensic.com
rpm_license: GPL3
rpm_group: Applications
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: rekall-forensics-1.7.2.rc1-1.el8.src.rpm
checksum_type: sha256
description:
  Rekall is an advanced forensic and incident response framework. While
  it began life purely as a memory forensic framework, it has now evolved
  into a complete platform.  Rekall implements the most advanced analysis
  techniques in the field, while still being developed in the open, with a
  free and open source license. Many of the innovations implemented within
  Rekall have been published in peer reviewed papers .

  Rekall provides an end-to-end solution to incident responders and forensic
  analysts. From state of the art acquisition tools, to the most advanced
  open source memory analysis framework.


pkgId: 7ff0e11522d2def8d8cd0768c35fe9ee477cc07258113164b7e3fc4acab2b0e8
name: rifiuti
arch: src
version: 20040505_1
epoch: 0
release: 1.el8
summary: Examine the contents of INFO2 in the Windows Recycle bin
url: http://www.mcafee.com/us/downloads/free-tools/rifiuti.aspx
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers
location_href: rifiuti-20040505_1-1.el8.src.rpm
checksum_type: sha256
description:
  Rifiuti, the Italian word meaning "trash", was developed to examine
  the contents of the INFO2 file in the Recycle Bin. Rifiuti will parse
  the information in an INFO2 file and output the results in a field
  delimited manner so that it may be imported into your favorite spreadsheet
  program. Rifiuti is built to work on multiple platforms and will execute
  on Windows (through Cygwin), Mac OS X, Linux, and *BSD platforms.


pkgId: b1786fe43fbde408e4951e73ed03159e1bd25f421ea49567329b6696decbac16
name: scalpel
arch: src
version: 2.0
epoch: 0
release: 7.el8
summary: Fast file carver working on disk images
url: http://www.digitalforensicssolutions.com/Scalpel/
rpm_license: GPLv2+
rpm_group: Applications/System
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: scalpel-2.0-7.el8.src.rpm
checksum_type: sha256
description:
  Scalpel is a fast file carver that reads a database of header and footer
  definitions and extracts matching files from a set of image files or raw
  device files. Scalpel is independent on used file-system and will carve
  files from FATx, NTFS, ext2/3, or raw partitions. It is useful for both
  digital forensics investigation and file recovery.


pkgId: cca056bdf5aa21214884f5280253b577ac4b65178ea605dbc41f3b5aea90f0a1
name: scrounge-ntfs
arch: src
version: 0.9
epoch: 0
release: 1.el8
summary: Data recovery program for NTFS file systems
url: http://thewalter.net/stef/software/scrounge/
rpm_license: BSD
rpm_group: File tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: scrounge-ntfs-0.9-1.el8.src.rpm
checksum_type: sha256
description:
  scrounge-ntfs is a utility that can rescue data from corrupted NTFS partitions. It
  writes the files retrieved to another working file system. Certain
  information about the partition needs to be known in advance.


pkgId: 494ed12a600ca180e8934ea05b3c27807bbf0b81db55c0d5fd06f2f1c729485c
name: sfdumper
arch: src
version: 2.2
epoch: 0
release: 1.el8
summary: A Selective File Dumper program built on top of the Sleuthkit
url: http://sfdumper.sourceforge.net/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: sfdumper-2.2-1.el8.src.rpm
checksum_type: sha256
description:
  SFDumper is a Selective File Dumper program built on top of the Sleuthkit.
  There is a windowed interface named sfdumper-gui.


pkgId: 2b0e2930d958817260e57e69bdb5cef80b8b0edb06014f15ff974be794849ff6
name: shellbags
arch: src
version: 0.5.5
epoch: 0
release: 1.el8
summary: Cross-platform shellbag parser
url: http://www.williballenthin.com/forensics/shellbags/index.html
rpm_license: Apache 2.0
rpm_group: Development/Libraries/Python
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: shellbags-0.5.5-1.el8.src.rpm
checksum_type: sha256
description:
  Microsoft Windows uses a set of Registry keys known as "shellbags"
  to maintain the size, view, icon, and position of a folder when using
  Explorer. These keys are useful to a forensic investigator. Shellbags
  persist information for directories even after the directory is removed,
  which means that they can be used to enumerate past mounted volumes,
  deleted files, and user actions. Yuandong Zhu, Pavel Gladyshev, and Joshua
  James provided a nice overview of the investigative value of shellbags in
  "Using shellbag information to reconstruct user activities" [pdf]; however,
  they do not describe how to programmatically access the data. Allan S Hay
  went into greater detail in his December, 2004 document "MiTeC Registry
  Analyser" [pdf], although he also leaves out a thorough analysis of the
  format. TZWorks provides an effective closed-source shellbag parser sbag,
  but does not explain its algorithm. Yogesh Khatri first described the basic
  structure of Windows Shell Items in his blog post for 42 LLC entitled Shell BAG
  Format Analysis. Joachim Metz went on to described the binary format of the
  Windows Shell Item structures with great detail in Windows Shell Item format
  specification [pdf]. This page documents an approach to parsing shellbags in
  detail, as well as introduces an open-source, cross-platform shellbag parser.


pkgId: eaf6baa6aa8634905d80dd6a60d9ec2ff033f07473837d571988a32341fbe5b0
name: silk
arch: src
version: 3.19.2
epoch: 0
release: 1.el8
summary: SiLK: A network flow collection and analysis package
url: http://tools.netsa.cert.org/silk/
rpm_license: GPLv2
rpm_vendor: CERT Network Situational Awareness <netsa-help@cert.org>
rpm_group: Applications/System
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: silk-3.19.2-1.el8.src.rpm
checksum_type: sha256
description:
  SiLK, the System for Internet-Level Knowledge, is a collection of
  traffic analysis tools developed by the CERT Network Situational
  Awareness Team (CERT NetSA) to facilitate security analysis of large
  networks. The SiLK tool suite supports the efficient collection,
  storage and analysis of network flow data, enabling network security
  analysts to rapidly query large historical traffic data sets. SiLK is
  ideally suited for analyzing traffic on the backbone or border of a
  large, distributed enterprise or mid-sized ISP.

  SiLK consists of two sets of tools: a packing system and analysis
  suite. The packing system receives network flow information from
  Netflow v5 or any IPFIX-based flowmeter and converts them into a more
  space efficient format, recording the packed records into
  service-specific, binary flat files. The analysis suite consists of
  tools which can read these flat files and then perform various query
  operations, ranging from per-record filtering to statistical analysis
  of groups of records. The analysis tools interoperate using pipes,
  allowing a user to develop a relatively sophisticated query from a
  simple beginning.


pkgId: 1038c790f4570f42de7fd665bae4489e7cdb91838247ee1ef51aa4c9a71b14ac
name: silk-ipa
arch: src
version: 1.0
epoch: 0
release: 1.el8
summary: silk-ipa - SiLK with the IPA Suite and PostgreSQL
url: http://www.cert.org/forensics/repository
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: silk-ipa-1.0-1.el8.src.rpm
checksum_type: sha256
description:
  This package contains a script named EnableSilkWithIPA that
  enables the forensics-sip (Silk with Ipa and Postgresql)
  repostory, installs needed packages, and then provides a
  URL to configure these tools


pkgId: e8dc3c6fb5ff44f20c9c3739ce18245dc19edce63fe23a20b30f70f073b2dd2b
name: silk-ipset
arch: src
version: 3.18.0
epoch: 0
release: 1.el8
summary: SiLK IPset: Library and tools for manipulating sets of IP Addresses
url: http://tools.netsa.cert.org/silk-ipset/index.html
rpm_license: GPLv2
rpm_vendor: CERT Network Situational Awareness <netsa-help@cert.org>
rpm_group: Applications/System
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: silk-ipset-3.18.0-1.el8.src.rpm
checksum_type: sha256
description:
  The SiLK IPset packages contain a library and a set of command line
  tools to build and manipulate IPset files, which are binary files
  containing a set of IP addresses.

  The SiLK IPset packages are derived from the SiLK traffic analysis
  tools developed by the CERT Network Situational Awareness Team (CERT
  NetSA).  Since the SiLK IPset packages contain a small subset of the
  tools in the SiLK package, there is no need to install the SiLK IPset
  packages when the SiLK packages are installed.


pkgId: 41f93f983ea4c05e2b601c7e01ddadd016aff3cdf7baf0a0e0b042f8f5c0b88a
name: sleuthkit
arch: src
version: 4.11.1
epoch: 0
release: 2.1.el8
summary: The Sleuth Kit (TSK)
url: http://www.sleuthkit.org
rpm_license: CPL and IBM and GPLv2+
rpm_group: Applications/System
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: sleuthkit-4.11.1-2.1.el8.src.rpm
checksum_type: sha256
description:
  The Sleuth Kit (TSK) is a collection of UNIX-based command line tools that
  allow you to investigate a computer. The current focus of the tools is the
  file and volume systems and TSK supports FAT, Ext2/3, NTFS, UFS,
  and ISO 9660 file systems


pkgId: c318473354b61fbc27e76795a593f8a3afdff734c2fb9e6ffe6e68dd49d65c9c
name: snarf
arch: src
version: 0.3.0
epoch: 0
release: 3.el8
summary: snarf - Structured Network Alert Reporting Framework
url: http://tools.netsa.cert.org/snarf
rpm_license: LGPLv2
rpm_vendor: CERT Network Situational Awareness <netsa-help@cert.org>
rpm_group: Applications/System
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: snarf-0.3.0-3.el8.src.rpm
checksum_type: sha256
description:
  snarf is a distributed alert reporting system. Applications can use snarf's C
  and Python APIs to construct and send network alert messages, which can then be
  routed to multiple destinations in a configurable manner.


pkgId: ec32dfe3b0c8ac8f5ede94f8161a37c0abf94c18e16ac48b48cbcaf08d8fa58c
name: snort
arch: src
version: 2.9.19
epoch: 1
release: 1.el8
summary: An open source Network Intrusion Detection System (NIDS)
url: http://www.snort.org/
rpm_license: GPL
rpm_vendor: Snort.org
rpm_group: Applications/Internet
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Official Snort.org RPMs
location_href: snort-2.9.19-1.el8.src.rpm
checksum_type: sha256
description:
  Snort is an open source network intrusion detection system, capable of
  performing real-time traffic analysis and packet logging on IP networks.
  It can perform protocol analysis, content searching/matching and can be
  used to detect a variety of attacks and probes, such as buffer overflows,
  stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts,
  and much more.

  Snort has three primary uses. It can be used as a straight packet sniffer
  like tcpdump(1), a packet logger (useful for network traffic debugging,
  etc), or as a full blown network intrusion detection system.

  You MUST edit /etc/snort/snort.conf to configure snort before it will work!

  Please see the documentation in /usr/share/doc/snort-2.9.19 for more
  information on snort features and configuration.


pkgId: f2086ce6743830c1a216ebcd5088e07955295bd02ff16842b7c09a692d983578
name: snort
arch: src
version: 3.1.42.0
epoch: 1
release: 1.el8
summary: An open source Network Intrusion Detection System (NIDS)
url: http://www.snort.org/
rpm_license: GPL
rpm_vendor: Snort.org
rpm_group: Applications/Internet
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Official Snort.org RPMs
location_href: snort-3.1.42.0-1.el8.src.rpm
checksum_type: sha256
description:
  Snort is an open source network intrusion detection system, capable of
  performing real-time traffic analysis and packet logging on IP networks.
  It can perform protocol analysis, content searching/matching and can be
  used to detect a variety of attacks and probes, such as buffer overflows,
  stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts,
  and much more.

  Snort has three primary uses. It can be used as a straight packet sniffer
  like tcpdump(1), a packet logger (useful for network traffic debugging,
  etc), or as a full blown network intrusion detection system.

  You MUST edit /etc/snort/snort.conf to configure snort before it will work!

  Please see the documentation in /usr/share/doc/snort-3.1.42.0 for more
  information on snort features and configuration.


pkgId: 4a789009054422d5bca695294bf6fe8a9cf3d9dc47ccba7ac6c55d0bf5f1f969
name: stegdetect
arch: src
version: 0.6
epoch: 0
release: 2.el8
summary: Detect and extract steganography messages inside JPEG
url: https://github.com/abeluck/stegdetect
rpm_license: BSD
rpm_group: File tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: stegdetect-0.6-2.el8.src.rpm
checksum_type: sha256
description:
  Stegdetect is an automated tool for detecting steganographic content in
  images. It is capable of detecting several different steganographic
  methods to embed hidden information in JPEG images. Currently, the
  detectable schemes are jsteg, jphide, invisible secrets, outguess 01.3b,
  F5, appendX, and camouflage. Using linear discriminant analysis, it also
  supports detection of new stego systems. Stegbreak is used to launch
  dictionary attacks against JSteg-Shell, JPHide, and OutGuess 0.13b.


pkgId: 1bfb99490c3ae1e650890427b4f9255256ef6136f217e6af514f2ef7673eaeb0
name: super_mediator
arch: src
version: 1.9.0
epoch: 0
release: 1.el8
summary: IPFIX Super Mediator for use with the YAF and SiLK tools
url: http://tools.netsa.cert.org/super_mediator/
rpm_license: GPLv2
rpm_group: Applications/System
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Emily Sarneso <ecoff@cert.org>
location_href: super_mediator-1.9.0-1.el8.src.rpm
checksum_type: sha256
description:
  super_mediator is an IPFIX mediator for use with the YAF and SiLK tools.
  It collects and filters YAF output data to various IPFIX collecting processes
  and/or csv files. super_mediator can be configured to perform de-duplication
  of DNS resource records, SSL certificates, or HTTP header fields as exported
  by YAF.


pkgId: 598f9bae776101fdcf348087c0da3df097cc1907707a2244e57a6b97f2181102
name: tcpxtract
arch: src
version: 1.0.1
epoch: 0
release: 20.el8
summary: Tool for extracting files from network traffic
url: http://tcpxtract.sourceforge.net/
rpm_license: GPLv2+
rpm_group: Applications/Internet
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: tcpxtract-1.0.1-20.el8.src.rpm
checksum_type: sha256
description:
  tcpxtract is a tool for extracting files from network traffic based on
  file signatures.
  tcpxtract features the following:
   * Supports 26 popular file formats out-of-the-box. New formats can be
   added by simply editing its config file.
   * With a quick conversion, you can use your old Foremost config file
   with tcpxtract.
   * Custom written search algorithm is lightning fast and very scalable.
   * Search algorithm searches across packet boundries for total coverage
   and forensic quality.
   * Uses libpcap, a popular, portable and stable library for network data
   capture
   * Can be used against a live network or a tcpdump formatted capture file.


pkgId: 2d11ca06941abb9420df6f839907582bddc9925d4be1f244847de29bdbc40071
name: tre
arch: src
version: 0.8.0
epoch: 0
release: 18.20140228gitc2f5d13.el8
summary: POSIX compatible regexp library with approximate matching
url: http://laurikari.net/tre/
rpm_license: BSD
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: tre-0.8.0-18.20140228gitc2f5d13.el8.src.rpm
checksum_type: sha256
description:
  TRE is a lightweight, robust, and efficient POSIX compatible regexp
  matching library with some exciting features such as approximate
  matching.


pkgId: ed1abdd290c477893bb20e91736412e8d060a78f6dbbbb8d07e166d19282dde1
name: testdisk
arch: src
version: 7.1
epoch: 0
release: 1.1.el8
summary: Tool to check and undelete partition, PhotoRec recovers lost files
url: https://www.cgsecurity.org/wiki/TestDisk
rpm_license: GPLv2+
rpm_group: Applications/System
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: ttestdisk-7.1-1.1.el8.src.rpm
checksum_type: sha256
description:
  Tool to check and undelete partition. Works with FAT12, FAT16, FAT32,
  NTFS, ext2, ext3, ext4, btrfs, BeFS, CramFS, HFS, JFS, Linux Raid, Linux
  Swap, LVM, LVM2, NSS, ReiserFS, UFS, XFS.
  PhotoRec is a signature based file recovery utility. It handles more than
  440 file formats including JPG, MSOffice, OpenOffice documents.


pkgId: b87c76749ca33ca4a3be6ca008b27125c625b2ba7ceffb754379b66759a18bd0
name: umit
arch: src
version: 1.0
epoch: 0
release: 17.1.el8
summary: Nmap front-end
url: http://umit.sourceforge.net/
rpm_license: GPLv2+ and LGPLv2+
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: umit-1.0-17.1.el8.src.rpm
checksum_type: sha256
description:
  With Umit, you have all the power provided by Nmap through its regular
  command line interface, and a lot more in a highly usable and portable
  Graphical Interface. Some of its main features include:
      * Easily create powerful Nmap commands and save them as profiles to use
        whenever you need it
      * Edit your Profiles using the Interface Editor
      * Create Profiles with the assistance of a Wizard
      * Group and order you scan results
      * Filter hosts list by services
      * Filter services list by hosts
      * Compare two scan results in one of our three compare modes: text diff,
        graphical comparison and HTML diff
      * Search scan results
      * Use Umit interface through the Web


pkgId: 6b66f42caa64ff3692172696cb6a0cb6f1fdcab490726852902ce2e0a3f43345
name: undbx
arch: src
version: 0.21
epoch: 0
release: 1.el8
summary: undbx - Tool to extract, recover and undelete e-mail messages from Outlook Express .dbx files
url: https://sourceforge.net/projects/undbx/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: undbx-0.21-1.el8.src.rpm
checksum_type: sha256
description:
  Tool to extract, recover and undelete e-mail messages from Outlook Express
  .dbx files. On first run all messages are extracted as individual .eml
  files. Subsequent runs only update the output directory with new messages,
  and delete old .eml files that correspond to deleted messages in the .dbx
  file. Corrupted .dbx files (including files larger than 2GB) can be opened in
  recovery mode, in order to recover messages and partially undelete deleted
  messages. The success of recovery depends on the type and level of .dbx
  file corruption.


pkgId: ea68383b9f208e28d41e4e7226a17b37eeb3c8569a2e2ed6684425abc3d99550
name: untex
arch: src
version: 1.3
epoch: 0
release: 3.1.el8
summary: Command to strip LaTeX commands from input
url: https://github.com/lukasdietrich/untex
rpm_license: GPL
rpm_group: Applications/Publishing
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: untex-1.3-3.1.el8.src.rpm
checksum_type: sha256
description:
  Like detex untex removes some LaTeX commands from the files listed in the
  arguments (or standard input) and prints the output to standard output.
  Has some alternative options, and the source code too, of course.


pkgId: 0b6ae72797343bf17e047f44130fde51204536c9aaf4fb91c3269d7dffdc5c43
name: videosnarf
arch: src
version: 0.63
epoch: 0
release: 1.el8
summary: Output detected media sessions
url: http://ucsniff.sourceforge.net/videosnarf.html
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: videosnarf-0.63-1.el8.src.rpm
checksum_type: sha256
description:
  VideoSnarf is a new security assessment tool that takes an offline
  pcap as input, and outputs any detected media streams (RTP sessions),
  including common audio codecs as well as H264 Video support. Why did we
  write VideoSnarf? To give security assessment professionals options to
  decode media traffic other than forcing them to use UCSniff. We know that
  some people, for whatever reason, might not be using UCSniff to capture
  and decode VoIP/Video traffic. For example, some people might want to
  use Ettercap and their favorite Sniffer (tshark/Wireshark) to capture
  the traffic, or they might have a monitor SPAN Session and are running
  a dedicated sniffer and want to re-construct the traffic just using a
  pcap trace file. VideoSnarf was inspired by the rtpbreak tool. To our
  knowledge, it is the first tool to detect RTP sessions that are encoded
  with the H.264 Video Codec, and output raw H264 files. VideoSnarf
  also supports the following common audio codecs: G711ulaw, G711alaw,
  G722, G729, G723, and G726. These are the most common audio codecs
  found in enterprise networks where you are going to be doing security
  assessments.


pkgId: a830fb06ffb6b89baa3a5f15cdb70843029257473564928098bf67a771488b3e
name: vmfs-tools
arch: src
version: 0.2.5
epoch: 0
release: 3.el8
summary: Tools to access VMFS filesystems
url: http://glandium.org/projects/vmfs-tools/
rpm_license: GPL-2.0+
rpm_group: System/Filesystems
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: vmfs-tools-0.2.5-3.el8.src.rpm
checksum_type: sha256
description:
  Originally loosely based on the vmfs code from fluidOps, this set of tools has
  since evolved to handle more features from VMFS, such as extents, and allows to
  access VMFS through the standard Linux VFS with the help of the FUSE framework.

  While it is still work in progress and is not destined for production use yet,
  it can be of some help for some people.


pkgId: a9e320baace558d4ed1317fc81cf95af23f2d10a0d16e59dcf2d16f632476259
name: wdpassport-utils
arch: src
version: 0.2
epoch: 0
release: 3.el8
summary: Lock, Unlock, and Manage Western Digital My Passport Drives
url: https://github.com/0-duke/wdpassport-utils
rpm_license: GPL3
rpm_group: Applications
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: wdpassport-utils-0.2-3.el8.src.rpm
checksum_type: sha256
description:
  A Linux command-line utility to lock, unlock, and manage the hardware encryption functionality
  of Western Digital My Passport external drives. Written in Python 3.

  WD My Passport drives support hardware encryption. New drives arrive in a passwordless state ---
  they can be used without locking or unlocking. After a password is set, drives become locked
  when they are unplugged and must be unlocked when they are plugged in to mount the volume and
  see its content.

  This utlity can:

  * Show drive status.
  * Set and change the drive's password.
  * Unlock an encrypted drive, given the password.
  * Reset the drive in case of a lost password.
  * Passwords given on the command line are converted into binary password data in a mechanism
    intended to be compatible with WD's unlock software that is used in Microsoft Windows.

  This tool was originally written by 0-duke in 2015 based on reverse engineering research by
  DanLukes and an implementation by DanLukes and KenMacD. crypto-universe converted this project
  and the underlying SCSI interface library py_sg to Python 3. JoshData updated the library to
  work with the latest WD My Passport device.


pkgId: bb92e9581b2b51a15adfab5d67332bd8e121d47b0f70a516b31df8ccfa1bede9
name: winevt-kb
arch: src
version: 20190507
epoch: 0
release: 1.el8
summary: winevt-kb - Windows Event Log Knowledge Base
url: https://github.com/libyal/winevt-kb/wiki
rpm_license: ASL 2.0
rpm_vendor: cert.org
rpm_group: Applications
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: winevt-kb-20190507-1.el8.src.rpm
checksum_type: sha256
description:
  winevt-kb is a project to build a Windows Event Log knowledge base.

  winevtrc is a Python module part of winevt-kb to allow reuse of Windows Event Log resources.


pkgId: 1277ab81e4b91e6b599a9768a80fdb8506577ec8f2804c93a99542e8079fc277
name: winreg-kb
arch: src
version: 20190507
epoch: 0
release: 1.el8
summary: winreg-kb - A project to build a Windows Registry Knowledge Base
url: https://github.com/libyal/winreg-kb/wiki
rpm_license: ASL 2.0
rpm_vendor: cert.org
rpm_group: Applications
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: winreg-kb-20190507-1.el8.src.rpm
checksum_type: sha256
description:
  winreg-kb is a project to build a Windows Registry Knowledge Base.

  winregrc is a Python module part of winreg-kb to allow reuse of Windows
  Registry Resources.


pkgId: 49348277067f8ceeff6578679e153e2692d81028fd1551a0f3bb0e735dde0b08
name: xmount
arch: src
version: 0.7.6
epoch: 0
release: 9.el8
summary: A on-the-fly convert for multiple hard disk image types
url: https://www.pinguin.lu/index.php
rpm_license: GPLv3+
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: xmount-0.7.6-9.el8.src.rpm
checksum_type: sha256
description:
  xmount allows you to convert on-the-fly between multiple input
  and output hard disk image types. xmount creates a virtual file
  system using FUSE (Filesystem in Userspace) that contains a virtual
  representation of the input image. The virtual representation can
  be in raw DD, VirtualBox's virtual disk file format or in VmWare's
  VMDK file format. Input images can be raw DD, EWF (Expert Witness
  Compression Format) or AFF (Advanced Forensic Format) files. In
  addition, xmount also supports virtual write access to the output
  files that is redirected to a cache file. This makes it possible
  to boot acquired hard disk images using QEMU, KVM, VirtualBox,
  VmWare, or alike.


pkgId: f621b701b5ef1e6cbfc960ffd330d702396a1206d00145a844e1d5a0b18938c1
name: xplico
arch: src
version: 1.2.2
epoch: 0
release: 3.el8
summary: Internet traffic decoder and network forensic analysis tool
url: http://www.xplico.org/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: xplico-1.2.2-3.el8.src.rpm
checksum_type: sha256
description:
  The goal of Xplico is extract from an internet traffic capture the
  applications data contained.  For example, from a pcap file Xplico
  extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents,
  each VoIP call (SIP), FTP, TFTP, and so on. Xplico isn’t a network
  protocol analyzer. Xplico is an open source Network Forensic Analysis Tool
  (NFAT).


pkgId: d2c6f4dff030a7c3a5ed4911905b6b0ab6f09f5f81cc2e3a6a04fe7b18b765b3
name: xva-img
arch: src
version: 1.4.2
epoch: 0
release: 2.el8
summary: xva-img - Assemble Citrix XEN disk image
url: https://github.com/eriklax/xva-img
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: xva-img-1.4.2-2.el8.src.rpm
checksum_type: sha256
description:
  Citrix Xen uses a custom virtual appliance format for import/export called "XVA". it's basically
  a strangely crafted tar-file. You don't need this program to unpack this tar-file, just use
  your favourite tar unpacker (tar, gtar, bsdtar). Once unpacked you will end up with a lot of
  different files, ova.xml (which contains the settings for the virtual appliance, think VMware
  vmx) and a number of folders called Ref:/, this is your disks. Each of these folders contain
  hundreds of files named 00000000, 00000001 with a accompanying .CHECKSUM file (SHA1). Each file
  is a 1MB slice of the disk, but some of the files in the sequence will probably be missing this is
  because XVA do not use compression; instead it will exclude slices of the disk that only contains
  zeros (are empty). This tool can assemble the disk for you (you will end up with a RAW disk)
  that can easily be mounted and modified. It can then also split the file again and generate
  checksum. Once ready, you will probably want to use the "package" command to rebuild the XVA file.


pkgId: 4f1b5537f4bdf813b6e6f198a39b354f72033a85b5e21ac8d9d244318c22a5dc
name: yaf
arch: src
version: 2.12.2
epoch: 0
release: 1.el8
summary: Yet Another Flow sensor
url: http://tools.netsa.cert.org/yaf/
rpm_license: GPL
rpm_vendor: http://tools.netsa.cert.org/
rpm_group: NetSA
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
rpm_packager: Tony Cebzanov <tonyc@cert.org>
location_href: yaf-2.12.2-1.el8.src.rpm
checksum_type: sha256
description:
  YAF is Yet Another Flow sensor. It processes packet data from pcap(3) dumpfiles
  as generated by tcpdump(1) or via live capture from an interface using pcap(3)
  or an Endace DAG card into bidirectional flows, then exports those flows to
  IPFIX Collecting Processes or in an IPFIX-based file format. YAF's output can
  be used with the NetSA Aggregated Flow (NAF) toolchain.


pkgId: 63f433a636e9c517971c5ec617015dfead2531968883f81659f10f3c59b65fc8
name: yara
arch: src
version: 4.2.3
epoch: 0
release: 1.el8
summary: Pattern matching Swiss knife for malware researchers
url: http://VirusTotal.github.io/yara/
rpm_license: BSD-3-Clause
rpm_group: Unspecified
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: yara-4.2.3-1.el8.src.rpm
checksum_type: sha256
description:
  YARA is a tool aimed at (but not limited to) helping malware researchers to
  identify and classify malware samples. With YARA you can create descriptions
  of malware families (or whatever you want to describe) based on textual or
  binary patterns. Each description, a.k.a rule, consists of a set of strings
  and a Boolean expression which determine its logic.


pkgId: 7f3a7698f38d02bfe4e08e0f4feef02542787c8bb65b6707c433774fc787de73
name: zeek
arch: src
version: 5.0.1
epoch: 0
release: 1
summary: Zeek is a powerful framework for network analysis and security monitoring
url: http://zeek.org
rpm_license: BSD-3-Clause
rpm_group: Productivity/Networking/Diagnostic
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: zeek-5.0.1-1.src.rpm
checksum_type: sha256
description:
  Zeek is a powerful network analysis framework that is much different from the
  typical IDS you may know.  While focusing on network security monitoring, Zeek
  provides a comprehensive platform for more general network traffic analysis as
  well. Well grounded in more than 15 years of research, Zeek has successfully
  bridged the traditional gap between academia and operations since its
  inception. Today, it is relied upon operationally in particular by many
  scientific environments for securing their cyberinfrastructure. Zeek's user
  community includes major universities, research labs, supercomputing centers,
  and open-science communities.


pkgId: 95efe8f02bc58bc71c5d205e56d1b6a5e585a40aca19966aff118c8f19b3cf64
name: zeromq
arch: src
version: 2.2.0
epoch: 0
release: 4.el8
summary: Software library for fast, message-based applications
url: http://www.zeromq.org
rpm_license: LGPLv3+
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: zeromq-2.2.0-4.el8.src.rpm
checksum_type: sha256
description:
  The 0MQ lightweight messaging kernel is a library which extends the
  standard socket interfaces with features traditionally provided by
  specialized messaging middle-ware products. 0MQ sockets provide an
  abstraction of asynchronous message queues, multiple messaging
  patterns, message filtering (subscriptions), seamless access to
  multiple transport protocols and more.

  This package contains the ZeroMQ shared library.


pkgId: db6841c5cfb7a2250d0cb48570527c017d874a7444272fb40734228de9253c02
name: zeromq3
arch: src
version: 3.2.5
epoch: 0
release: 3.el8
summary: Software library for fast, message-based applications
url: http://www.zeromq.org
rpm_license: LGPLv3+ with exceptions
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-centos-8-x86-64.cs2.cert.org
location_href: zeromq3-3.2.5-3.el8.src.rpm
checksum_type: sha256
description:
  The 0MQ lightweight messaging kernel is a library which extends the
  standard socket interfaces with features traditionally provided by
  specialized messaging middle-ware products. 0MQ sockets provide an
  abstraction of asynchronous message queues, multiple messaging
  patterns, message filtering (subscriptions), seamless access to
  multiple transport protocols and more.

  This package contains the ZeroMQ shared library for versions 3.x.


