Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to compile on RHEL 5 - duplicate of issue in 504endicsLabs/LiME repo in case it's not monitored. #1

Closed
untrusted opened this issue Mar 26, 2020 · 3 comments

Comments

@untrusted
Copy link

Howdy. I'm hoping this is the correct repo and I shouldn't be posting this in the kd8bny repo. Please let me know if I need to move it.
I'm attempting to compile LiME and generate Volatility profiles for all the legacy systems we have in our inventory and the compile is failing. Output of the make debug is below.
First things first - I'm trying this directly on the RHEL 5.7 box.
Here's it's stats:
uname -a
Linux nmsrheli386 2.6.18-274.el5PAE #1 SMP Fri Jul 8 17:59:09 EDT 2011 i686 i686 i386 GNU/Linux


cat /etc/redhat-release
Red Hat Enterprise Linux Server release 5.7 (Tikanga)


[root@nmsrheli386 /]# cat /proc/cpuinfo
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 158
model name : Intel(R) Core(TM) i7-9850H CPU @ 2.60GHz
stepping : 13
cpu MHz : 2592.002
cache size : 12288 KB
physical id : 0
siblings : 2
core id : 0
cpu cores : 2
apicid : 0
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 22
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss ht nx pdpe1gb rdtscp lm constant_tsc nonstop_tsc arat pni ssse3 cx16 sse4_1 sse4_2 popcnt lahf_lm abm 3dnowprefetch [8]
bogomips : 5184.00

processor : 1
vendor_id : GenuineIntel
cpu family : 6
model : 158
model name : Intel(R) Core(TM) i7-9850H CPU @ 2.60GHz
stepping : 13
cpu MHz : 2592.002
cache size : 12288 KB
physical id : 0
siblings : 2
core id : 1
cpu cores : 2
apicid : 1
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 22
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss ht nx pdpe1gb rdtscp lm constant_tsc nonstop_tsc arat pni ssse3 cx16 sse4_1 sse4_2 popcnt lahf_lm abm 3dnowprefetch [8]
bogomips : 5184.00


I ended up here after trying to use LiMEaide and noticing the compile was failing on the distant end, and so now I'm trying to just compile LiME.

When trying to do a make of LIME on the target directly I receive the below output:
[root@nmsrheli386 src]# make clean
rm -f .o .mod.c Module.symvers Module.markers modules.order ..o.cmd ..ko.cmd .*.o.d
rm -rf .tmp_versions
[root@nmsrheli386 src]# make debug
KCFLAGS="-DLIME_DEBUG" make CONFIG_DEBUG_SG=y -C /lib/modules/2.6.18-274.el5PAE/build M="/root/LiME-master/src" modules
make[1]: Entering directory /usr/src/kernels/2.6.18-274.el5-PAE-i686' CC [M] /root/LiME-master/src/tcp.o CC [M] /root/LiME-master/src/disk.o CC [M] /root/LiME-master/src/main.o CC [M] /root/LiME-master/src/hash.o /root/LiME-master/src/hash.c: In function ‘ldigest_update’: /root/LiME-master/src/hash.c:118: error: implicit declaration of function ‘sg_init_table’ /root/LiME-master/src/hash.c:119: error: implicit declaration of function ‘sg_set_page’ /root/LiME-master/src/hash.c:143: warning: label ‘update_fail’ defined but not used /root/LiME-master/src/hash.c:104: warning: unused variable ‘ret’ /root/LiME-master/src/hash.c: In function ‘ldigest_final’: /root/LiME-master/src/hash.c:179: warning: label ‘final_fail’ defined but not used /root/LiME-master/src/hash.c:151: warning: unused variable ‘ret’ make[2]: *** [/root/LiME-master/src/hash.o] Error 1 make[1]: *** [_module_/root/LiME-master/src] Error 2 make[1]: Leaving directory /usr/src/kernels/2.6.18-274.el5-PAE-i686'
make: *** [debug] Error 2
[root@nmsrheli386 src]#

The interesting thing is that the make error output is the same whether I'm compiling from this repo 504ensicsLabs/LiME or this repo kd8bny/LiME
With my limited google-fu those functions are related to something called scatterlist(?). I think...
So my questions are - can LiME even run on an older kernel and this version of RHEL? If so, based on the make debug output below is there something I can try as far as editing the makefile?
Any help is appreciated. I'd really like to get this working so I can then take advantage of the great LiMEaide tool. Again, I ended up here because I was running into an issue with LiMEaide where I could see the compiles weren't happening on the distant end.

*At the risk of confusing things, here's what I was originally seeing on the LiMEaide side which led me to trying to directly compile LiME

python3 limeaide.py -v -u root 192.168.146.132

.---. _______
| |.--. __ __ ___ ..... .--.\ ___ '. __.....__ | ||__|| |/ .' . .-'' '. |__| ' |--.\ \ .-'' '. | |.--.| .-. .-. ' / .-''"'-. . .--. | | \ ' / .-''"'-. . | || || | | | | |/ /________\ \ __ | | | | | '/ /________\ | | || || | | | | || | .:--.'. | | | | | || | | || || | | | | |\ .-------------'/ | \ || | | | ' .'\ .-------------' | || || | | | | | \ '-.____...---." __ | || | | |.' /' \ '-....---.
| ||||| || || . .' .'.''| ||__|/_______.'/ . .'
'---' ''-...... -' / / | |_ \_______|/ ''-...... -'
\ .
,\ '/
--' "
by kd8bny 2.0.1

LiMEaide is licensed under GPL-3.0
LiME is licensed under GPL-2.0

Establishing secure connection root@192.168.146.132
Password:
Would you like to select a pre-generated profile [y/N]
4247056384
5841556
Image will occupy approximately 4050 of 5704 MiB available
Sending LiME src to remote client
redhat-release
Red
Hat
Enterprise
Linux
Server
release
5.7
(Tikanga)
Cannot determine distribution. Please enter distribution name: 2.6.18-274.el5PAE
2.6.18-274.el5PAE
i686
Building loadable kernel module
make:


No
rule
to
make
target
symbols'. Stop. mv: cannot stat ./.limeaide_working/lime-2.6.18-274.el5PAE.ko':
No
such
file
or
directory

Detected 2.6.18-274.el5PAE 2.6.18-274.el5PAE i686
Installing LiME and retrieving RAM

path=./.limeaide_working/dump.lime
format=lime
digest=sha1
insmod:
can't
read
'./.limeaide_working/lime-2.6.18-274.el5PAE-2.6.18-274.el5PAE-i686.ko':
No
such
file
or
directory
Changing permissions
chmod:
cannot
access
`./.limeaide_working/dump.lime':
No
such
file
or
directory
Beam me up Scotty
Computing message digest of image
Traceback (most recent call last):
File "limeaide.py", line 245, in
Limeaide().main()
File "limeaide.py", line 237, in main
lime.deploy()
File "/home/sansforensics/Projects/LiMEaide-master/lib/deploy_lime.py", line 229, in deploy
self.session.check_integrity()
File "/home/sansforensics/Projects/LiMEaide-master/lib/session/session.py", line 71, in check_integrity
with open(self.client.output_dir + self.client.output, 'rb') as f:
FileNotFoundError: [Errno 2] No such file or directory: './output/192.168.146.132_2020_03_24T22_47_20/dump.lime'
root@siftworkstation -> /h/s/P/LiMEaide-master

@kd8bny
Copy link
Owner

kd8bny commented Mar 27, 2020

Hey there. Don't worry about the differences between LiME and LiMEaide. As LiMEaide is just a mechanism for deployment and uses the same LiME.

Do you have the kernel-headers installed?

If you do have the headers installed it look like this rhel doesn't like the hash function of LiME. You can edit the Makefile and remove the references to hash.o and hash.c . If you continue with any issues please reach back out

@kd8bny
Copy link
Owner

kd8bny commented Mar 27, 2020

I just saw this is a dup to the issue on the LiME repo so I'm going to close the issue here.

@kd8bny kd8bny closed this as completed Mar 27, 2020
@untrusted
Copy link
Author

Great. Thank you for deleting the duplicate.
With telework, go in, telework, go into work, etc. I am now just getting back to this.
I'm going to remove those references and report back.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants