1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
|
# MacOS Source release
To install the "Source code" release of Plaso on MacOS you need to download the
latest version from https://github.com/log2timeline/plaso/releases/latest
For the purposes of this guide it will use 20200430 to represent the latest
Plaso release in the examples below. However, you will need to adjust this
based on the latest version available from the link above.
Under the latest release you should see four links to different packages, you
will need to download the "**Source code (tar.gz)**" package file, for example
https://github.com/log2timeline/plaso/archive/20200430.tar.gz
Extract the source code:
```
cd /tmp
tar zxf ~/Downloads/plaso-20200430.tar.gz
```
In some cases, MacOS will automatically ungzip the downloaded file. In which
case, untar with:
```
cd /tmp
tar xf ~/Downloads/plaso-20200430.tar
```
XCode Command Line Tools is required. It can be installed with:
```
xcode-select --install
```
If python3 is not already installed, it can be downloaded from
https://www.python.org/downloads/
## Install Plaso contained within a virtual environment
Plaso can be installed within a virtual environment so that dependency packages
are not installed system-wide. To do this, install Virtualenv:
```
sudo pip3 install virtualenv
```
Create a virtual environment to install Plaso into (in this instance, it is
named "plaso_env" created under the home directory):
```
virtualenv -p python3 ~/plaso_env
```
Activate the virtual environment:
```
source ~/plaso_env/bin/activate
```
Install the Plaso dependencies:
```
cd /tmp/plaso-20200430/
pip install -r requirements.txt
```
Install Plaso:
```
python setup.py build
python setup.py install
```
To deactivate the virtual environment:
```
deactivate
```
*In order to run Plaso, the virtual environment needs to be activated.*
## Install Plaso system-wide
**We strongly discourage installing Plaso system-wide with pip. If you aren't
comfortable debugging package installation, this is not for you.**
Install the Plaso dependencies:
```
cd /tmp/plaso-20200430/
sudo pip3 install -r requirements.txt
```
Install Plaso:
```
python3 setup.py build
sudo python3 setup.py install
```
## Troubleshooting
Some Python dependencies fail to compile with the error:
```
clang: warning: no such sysroot directory: '/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.14.sdk' [-Wmissing-sysroot]
...
#include <stdio.h>
^~~~~~~~~
1 error generated.
error: command 'clang' failed with exit status 1
```
It is likely that the Python interpreter was built using a specific MacOS SDK.
Make sure that version of the MacOS SDK is installed on your system, in the
example above this is MacOS SDK 10.14.
Pycrypto fails to build with the error:
```
src/_fastmath.c:36:11: fatal error: 'gmp.h' file not found
# include <gmp.h>
^~~~~~~
1 error generated.
error: command 'clang' failed with exit status 1
----------------------------------------
```
Make sure you have gmp installed:
```
brew install gmp
```
And your build environment knows where to find its development files:
```
export CFLAGS="-I/usr/local/include ${CFLAGS}";
export LDFLAGS="-L/usr/local/lib ${LDFLAGS}";
```
Yara-python fails to build with the error:
```
In file included from yara/libyara/libyara.c:45:
yara/libyara/crypto.h:38:10: fatal error: 'openssl/crypto.h' file not found
#include <openssl/crypto.h>
^~~~~~~~~~~~~~~~~~
1 error generated.
error: command 'clang' failed with exit status 1
----------------------------------------
```
Make sure you have openssl installed:
```
brew install openssl
```
And your build environment knows where to find its development files:
```
export CFLAGS="-I/usr/local/opt/openssl@1.1/include ${CFLAGS}";
export LDFLAGS="-L/usr/local/opt/openssl@1.1/lib ${LDFLAGS}";
```
|
