Skip to content

Commit

Permalink
update README and installer script
Browse files Browse the repository at this point in the history
  • Loading branch information
slyles1001 committed Jan 22, 2025
1 parent da1f973 commit 7e8e437
Show file tree
Hide file tree
Showing 2 changed files with 36 additions and 25 deletions.
48 changes: 28 additions & 20 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -18,36 +18,44 @@ EyeON provides an automated, consistent process across users to scan software fi
## Installation
Eyeon can also be run in linux or WSL.

The simplest install can be done with pip:
```bash
git clone git@github.com:LLNL/pEyeON.git
pip install peyeon
```
or

However, this does not install a couple key dependencies, namely libmagic, ssdeep, and tlsh. A better way to install is via the docker scripts on the github page:
```bash
git clone https://github.com/LLNL/pEyeON.git
wget
```

### Dockerfile
This dockerfile contains all the pertinent tools specific to data extraction. The main tools needed are `ssdeep`, `libmagic`, `tlsh`, and `detect-it-easy`. There are a couple variables that need to be changed in order for it to work.

Run docker build script
### Dockerfile
This dockerfile contains all the pertinent tools specific to data extraction. The main tools needed are `ssdeep`, `libmagic`, `tlsh`, and `detect-it-easy`. We have written some convenient scripts:
```bash
./docker-build.sh
wget https://github.com/LLNL/pEyeON/blob/main/docker-build.sh \
https://github.com/LLNL/pEyeON/blob/main/docker-run.sh \
https://github.com/LLNL/pEyeON/blob/main/eyeon.Dockerfile
chmod +x docker-build.sh && ./docker-build.sh
chmod +x docker-run.sh && ./docker-run.sh
```

Run docker run script
This attaches the current directory as a working directory in the container. Files that need to be scanned should go in "tests" folder. If running in a docker container, the eyeon root directory is mounted to "/workdir", so place samples in "/workdir/samples" or "/workdir/tests/samples".

Cd into workdir directory:
```bash
./docker-run.sh
cd workdir
```

This attaches current the code directory as a working directory in the container. Files that need to be scanned should go in "tests" folder. If running in a docker container, the eyeon root directory is mounted to "/workdir", so place samples in "/workdir/samples" or "/workdir/tests/samples".
EyeON commands should work now.

Cd into workdir directory, install EyeON, and run 'rein' alias to build python dependencies:
Alternatively, to install on a clean Ubuntu VM:
```bash
cd workdir
rein
wget https://github.com/LLNL/pEyeON/blob/main/install-ubuntu.sh
chmod +x install-ubuntu.sh && ./install-ubuntu.sh
```

EyeON commands should work now.
To request other options for install, please create an issue on our GitHub page.


## Usage

Expand All @@ -72,20 +80,20 @@ EyeON consists of two parts - an observe call and a parse call. `observe.py` wor

#### Observe

1. This CLI command calls the observe function and makes an observation of a file.
1. This CLI command calls the `observe` function and makes an observation of a file.

CLI command:

```bash
eyeon observe notepad++.exe
eyeon observe demo.ipynb
```

Init file calls observe function in observe.py
Init file calls observe function in `observe.py`

```bash
obs = eyeon.observe.Observe("./tests/binaries/x86/notepad++/notepad++.exe")
obs = eyeon.observe.Observe("demo.ipynb")
```
The observation will output a json file containing unique identifying information such as hashes, modify date, certificate info, etc.
The observation will create a json file containing unique identifying information such as hashes, modify date, certificate info, etc.

Example json file:

Expand All @@ -107,7 +115,7 @@ Example json file:
```

#### Parse
parse.py calls observe recursively, returning an observation for each file in a directory.
`parse.py` calls `observe` recursively, returning an observation for each file in a directory.

```bash
obs = eyeon.parse.Parse(args.dir)
Expand Down
13 changes: 8 additions & 5 deletions install-ubuntu.sh
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@

export eyeon_dir=$(pwd)
# dependencies
apt update
apt-get update
DEBIAN_FRONTEND=noninteractive TZ=Etc/UTC \
apt install -y python3 python3-pip python3-dev python3-venv \
apt-get install -y python3 python3-pip python3-dev python3-venv \
libmagic1 git make wget unzip build-essential vim ssdeep jq

# cmake, have to build telfhash
Expand All @@ -20,9 +20,12 @@ cd /opt && git clone https://github.com/trendmicro/tlsh.git
cd /opt/tlsh
./make.sh

mkdir /opt/die && cd /opt/die
wget https://github.com/horsicq/DIE-engine/releases/download/${DIE}/die_${DIE}_Ubuntu_24.04_amd64.deb
apt-get install -y die_${DIE}_Ubuntu_24.04_amd64.deb
apt-get clean

cd $eyeon_dir
# set up virtual environment
python3 -m venv eye && source eye/bin/activate
pip install build sphinx
python3 -m build
pip install ./dist/eyeon-*.whl
pip install peyeon

0 comments on commit 7e8e437

Please sign in to comment.