3 ms·

This probably won't work on binaries that contain references to system files necessary in order to run the binary that aren't code. You usually can't detect the

This probably won't work on binaries that contain references to system files necessary in order to run the binary that aren't code. You usually can't detect them other than running the program and watching it die, or running the program with strace and looking for the files it's trying to stat/open. In the past what I've done when I have to copy a binary somewhere, is statically compile it in a Docker container and export the install files, then copy those over. I have about a half dozen tools prepped like that (gdb, curl, strace, busybox, etc)

gary_0 5y ago
You could also use a package manager utility to list which files are needed, assuming the target binary was installed that way. (pkgs.org lists the files every package installs, or locally you could run something like `apt-files`).
- cmeacham98 5y ago
  Maybe check out the --detect flag from the README that claims to do just that?
  - gary_0 5y ago
    Oh, wow! They've thought of everything.
  - throwaway984393 5y ago
    That will detect files in a system package, but not files in a system package depended on by a system package depended on by a system package. It depends on how the distro packages deps and how apps use them. There are apps which use non-linked files that are only provided in extra packages. And even if you walk the whole dependency graph for a single package and export all listed files, you miss files that are created and updated during the setup steps of a package install (which are not listed in the package).
    - Brian_K_White 5y ago
      As long as the automatic way finds most things, and there is any way to manually include arbitrary things, that is actually perfectly great to me. I don't understand what the complaint or expectation is here.
      - throwaway984393 5y ago
        Just trying to put out there to expect undefined behavior or failures. Users might not understand how applications work and so might expect more than is possible. The strace trick is a nice workaround but I didn't see it in the readme
foob 5y ago
You usually can't detect them other than running the program and watching it die, or running the program with strace and looking for the files it's trying to stat/open. You can actually pipe the output of strace into exodus and it will include the files that were accessed by the program in the bundle. For example: strace -f nmap --script default 127.0.0.1 2>&1 | exodus nmap
- throwaway984393 5y ago
  Oh. That's pretty cool

gary_0 5y ago

You could also use a package manager utility to list which files are needed, assuming the target binary was installed that way. (pkgs.org lists the files every package installs, or locally you could run something like `apt-files`).

cmeacham98 5y ago
Maybe check out the --detect flag from the README that claims to do just that?
- gary_0 5y ago
  Oh, wow! They've thought of everything.
- throwaway984393 5y ago
  That will detect files in a system package, but not files in a system package depended on by a system package depended on by a system package. It depends on how the distro packages deps and how apps use them. There are apps which use non-linked files that are only provided in extra packages. And even if you walk the whole dependency graph for a single package and export all listed files, you miss files that are created and updated during the setup steps of a package install (which are not listed in the package).
  - Brian_K_White 5y ago
    As long as the automatic way finds most things, and there is any way to manually include arbitrary things, that is actually perfectly great to me. I don't understand what the complaint or expectation is here.
    - throwaway984393 5y ago
      Just trying to put out there to expect undefined behavior or failures. Users might not understand how applications work and so might expect more than is possible. The strace trick is a nice workaround but I didn't see it in the readme

foob 5y ago

You usually can't detect them other than running the program and watching it die, or running the program with strace and looking for the files it's trying to stat/open. You can actually pipe the output of strace into exodus and it will include the files that were accessed by the program in the bundle. For example: strace -f nmap --script default 127.0.0.1 2>&1 | exodus nmap

throwaway984393 5y ago
Oh. That's pretty cool