If there's a malware analysis tool you'd like to see as part of the REMnux distro, consider creating the Salt State file that would allow the tool to be included. The following steps explain how you can build such a file.
Get a copy of the current REMnux/salt-state repository, which contains the REMnux Salt State files. A common way to do this is to run:
git clone https://github.com/REMnux/salt-states.git
Determine in which subdirectory under salt-states/remnux your new Salt State file should reside. Common locations are:
For Ubuntu packages:
For Python packages:
For tools distributed as compiled or JAR files:
For scipts that aren't installable using a package manager:
Instead of attempting to create a file from scratch, consider identifying a State File that operates similarly to what you have in mind, and copying its contents to form the basis of your new file.
Once the State File is ready, test it locally by running it in a Docker container. The easiest way to do it is to run the dev-state.sh script, which is a part of the REMnux/salt-state repository in the .ci directory.
Once you're at the command promot inside the tester container, direct SaltStack to process your new Salt State file by running this command in the container:
salt-call -l debug --local --retcode-passthrough --state-output=mixed state.sls STATE-PATH
In the command above, replace "STATE-PATH" with the Salt Stack path to your new file using dots instead of slashes. For example, if you were runing peframe.sls, which is in remnux/python-packages, you'd specify
The command will produce verbose debug-level output, so you can diagnose any issues. Adjust your new Salt State file to address whichever problems arise, so the
salt-call command completes successfully.
To make sure the tool is properly included in the REMnux tool listing, included the following metadata comments on top of your Salt State file to describe the tool:
# Name:# Website:# Description:# Category:# Author:# License:# Notes:
Once you have a working, tested Salt State file in the local copy of the REMnux/salt-states repoistory, create a GitHub pull request for that repo, so your file may be considered for inclusion in the REMnux distro. If the pull request isn't working, consider submitting the file to Lenny Zeltser by email.