Linux Dependencies

Status — 1.3.0: The Linux x64 binary (libfexcore.so) is not shipped in 1.3.0 — it is deferred to a 1.3.x patch release. This document describes the runtime dependencies that the patch release will require; nothing in the 1.3.0 SDK package will load against these instructions today.

FEX Core (libfexcore.so) is compiled with Delphi for Linux and links against glibc. This document covers dependency requirements for native Linux and Docker deployments.

Quick Install (Ubuntu 24.04)

# Install all runtime dependencies
sudo apt update
sudo apt install -y \
    libsqlite3-0 \
    libsnappy1v5 \
    libarchive13 \
    libyara10 \
    libraptor2-0 \
    libicu74 \
    libpcre2-16-0

# OpenSSL 1.1 requires manual installation (see below)

Dependency Table

Direct Dependencies

Library APT Package Version (Ubuntu 24.04) Purpose
libsqlite3.so.0 libsqlite3-0 3.45.1 Database format parsing
libsnappy.so.1 libsnappy1v5 1.1.10 Fast compression/decompression
libarchive.so.13 libarchive13 3.7.2 Archive formats (TAR, GZIP, BZIP2, XZ)
libyara.so.10 libyara10 4.5.0 Pattern matching / file type detection
libraptor2.so.0 libraptor2-0 2.0.16 RDF/metadata parsing (AFF4 format)
libicuuc.so.74 libicu74 74.2 Unicode support (Delphi RTL)
libpcre2-16.so.0 libpcre2-16-0 10.42 Regular expressions
libcrypto.so.1.1 See below 1.1.1f OpenSSL cryptography

Indirect Dependencies (auto-installed)

These are pulled in as dependencies of the packages above:

Library Purpose
libz.so.1 GZIP compression
liblzma.so.5 LZMA/XZ compression
libbz2.so.1.0 BZIP2 compression
libstdc++.so.6 C++ standard library
libc.so.6 C standard library (glibc)
libxml2.so.2 XML parsing (via libraptor2)
libicui18n.so.74 ICU internationalization
libicudata.so.74 ICU data

OpenSSL 1.1

Ubuntu 24.04 ships with OpenSSL 3.x, but FEX Core was compiled against OpenSSL 1.1. The libcrypto.so.1.1 library is not available in Ubuntu 24.04 repositories.

Solution: Install from Ubuntu 20.04 Package

wget -q http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2.24_amd64.deb
dpkg-deb -x libssl1.1_1.1.1f-1ubuntu2.24_amd64.deb /tmp/openssl11
sudo cp /tmp/openssl11/usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 /usr/local/lib/
sudo cp /tmp/openssl11/usr/lib/x86_64-linux-gnu/libssl.so.1.1 /usr/local/lib/
sudo ldconfig
rm -rf /tmp/openssl11 libssl1.1_*.deb

Security Note

OpenSSL 1.1 is end-of-life. The bundled library is used only for forensic image decryption (E01/EWF format). A future FEX Core release will migrate to OpenSSL 3.x.

Delphi's runtime loads ICU and PCRE2 by unversioned names. Create symlinks:

sudo ln -sf /usr/lib/x86_64-linux-gnu/libicuuc.so.74 /usr/local/lib/libicuuc.so
sudo ln -sf /usr/lib/x86_64-linux-gnu/libicui18n.so.74 /usr/local/lib/libicui18n.so
sudo ln -sf /usr/lib/x86_64-linux-gnu/libicudata.so.74 /usr/local/lib/libicudata.so
sudo ln -sf /lib/x86_64-linux-gnu/libpcre2-8.so.0 /usr/local/lib/libpcre2-8.so
sudo ln -sf /lib/x86_64-linux-gnu/libpcre2-16.so.0 /usr/local/lib/libpcre2-16.so
sudo ldconfig

Locale Configuration

FEX Core requires UTF-8 locale support:

sudo apt install locales
sudo sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen
sudo locale-gen

export LANG=en_US.UTF-8
export LC_ALL=en_US.UTF-8

Verification

After installing all dependencies:

# Check all libraries resolve
ldd /usr/local/lib/libfexcore.so | grep "not found"
# Should produce no output

# Quick load test with Python
python3 -c "
import ctypes
lib = ctypes.CDLL('/usr/local/lib/libfexcore.so')
print('Library loaded successfully')
print(f'InitLibrary: {lib.InitLibrary}')
"

The simplest way to run FEX Core on Linux is via Docker. Pre-built images include all dependencies:

docker pull getdataforensics/fexcore-slim:1.3.0
docker run --rm -v /path/to/images:/data getdataforensics/fexcore-slim:1.3.0 \
    python3 /app/fex_viewer.py /data/evidence.E01 info

See the Docker Guide for full documentation.