# Startup-SBOM | A Tool To Reverse Engineer And Inspect The RPM And APT Databases To List All The Packages

**URL:** <https://onehack.st/t/startup-sbom-a-tool-to-reverse-engineer-and-inspect-the-rpm-and-apt-databases-to-list-all-the-packages/284126>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, freebies\
**Created:** [June 6, 2024, 8:27pm UTC](https://onehack.st/t/startup-sbom-a-tool-to-reverse-engineer-and-inspect-the-rpm-and-apt-databases-to-list-all-the-packages/284126 "2024-06-06T20:27:34Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [June 6, 2024, 8:27pm UTC](https://onehack.st/t/startup-sbom-a-tool-to-reverse-engineer-and-inspect-the-rpm-and-apt-databases-to-list-all-the-packages/284126/1 "2024-06-06T20:27:34Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/9/b/9b49fc1177b538956da328620795bc836a7e1ea3.png)

# Startup-SBOM

This is a simple SBOM utility which aims to provide an insider view on which packages are getting executed.

The process and objective is simple we can get a clear perspective view on the packages installed by APT (_currently working on implementing this for RPM and other package managers_). This is mainly needed to check which all packages are actually being executed.

## Installation

The packages needed are mentioned in the `requirements.txt` file and can be installed using pip:

pip3 install -r requirements.txt

## Usage

- First of all install the packages.
- Secondly , you need to set up environment variables such as:
  - `Mount the image:` Currently I am still working on a mechanism to automatically define a mount point and mount different types of images and volumes but its still quite a task for me.

- Finally run the tool to list all the packages.

| Argument | Description |
| --- | --- |
| `--analysis-mode` | Specifies the mode of operation. Default is `static`. Choices are `static` and `chroot`. |
| `--static-type` | Specifies the type of analysis for static mode. Required for static mode only. Choices are `info` and `service`. |
| `--volume-path` | Specifies the path to the mounted volume. Default is `/mnt`. |
| `--save-file` | Specifies the output file for JSON output. |
| `--info-graphic` | Specifies whether to generate visual plots for CHROOT analysis. Default is `True`. |
| `--pkg-mgr` | Manually specify the package manager or dont add this option for automatic check. |
| **APT:** | |

- _Static Info Analysis:_
  - This command runs the program in static analysis mode, specifically using the Info Directory analysis method.
  - It analyzes the packages installed on the mounted volume located at `/mnt`.
  - It saves the output in a JSON file named `output.json`.
  - It generates visual plots for CHROOT analysis.

python3 main.py --pkg-mgr apt --analysis-mode static --static-type info --volume-path /mnt --save-file output.json

- _Static Service Analysis:_
  - This command runs the program in static analysis mode, specifically using the Service file analysis method.
  - It analyzes the packages installed on the mounted volume located at `/custom_mount`.
  - It saves the output in a JSON file named `output.json`.
  - It does not generate visual plots for CHROOT analysis.

python3 main.py --pkg-mgr apt --analysis-mode static --static-type service --volume-path /custom\_mount --save-file output.json --info-graphic False

- _Chroot analysis with or without Graphic output:_
  - This command runs the program in chroot analysis mode.
  - It analyzes the packages installed on the mounted volume located at `/mnt`.
  - It saves the output in a JSON file named `output.json`.
  - It generates visual plots for CHROOT analysis.
  - For graphical output keep `--info-graphic` as `True` else `False`

python3 main.py --pkg-mgr apt --analysis-mode chroot --volume-path /mnt --save-file output.json --info-graphic True/False

**RPM**

- _Static Analysis:_
  - Similar to how its done on apt but there is only one type of static scan avaialable for now.

python3 main.py --pkg-mgr rpm --analysis-mode static --volume-path /mnt --save-file output.json

- _Chroot analysis with or without Graphic output:_
  - Exactly how its done on apt.

python3 main.py --pkg-mgr rpm --analysis-mode chroot --volume-path /mnt --save-file output.json --info-graphic True/False

## Supporting Images

Currently the tool works on Debian and Red Hat based images I can guarentee the debian outputs but the Red-Hat onces still needs work to be done its not perfect.

I am working on the pacman side of things I am trying to find a relaiable way of accessing the pacman db for static analysis.

## Graphical Output Images (Chroot)

### APT Chroot

[![apt](https://github.com/morpheuslord/Startup-SBOM/raw/main/Docs/sample_output_images/apt.png)](https://github.com/morpheuslord/Startup-SBOM/blob/main/Docs/sample_output_images/apt.png)

### RPM Chroot

[![rpm](https://github.com/morpheuslord/Startup-SBOM/raw/main/Docs/sample_output_images/rpm.png)](https://github.com/morpheuslord/Startup-SBOM/blob/main/Docs/sample_output_images/rpm.png)

## Inner Workings

For the workings and process related documentation please read the wiki page: [Link](https://github.com/morpheuslord/Startup-SBOM/wiki)

## TODO

- Support for RPM
- Support for APT
- Support for Chroot Analysis
- Support for Versions
- Support for Chroot Graphical output
- Support for organized graphical output
- Support for Pacman

## Ideas and Discussions

Ideas regarding this topic are welcome in the discussions page.

## GitHub:

> **[GitHub - morpheuslord/Startup-SBOM: A tool to reverse engineer and inspect the RPM and...](https://github.com/morpheuslord/Startup-SBOM)**
>
> A tool to reverse engineer and inspect the RPM and APT databases to list all the packages along with executables, service and versions.