Rust · Cargo

Build the capability you need.

Cargo features keep the minimal collector lean and add external tools or upload transports only when required.

Download a published binary

Release binaries are standalone executables. Windows is listed first; choose the architecture that matches the endpoint.

Windows64-bit · x86_648.7 MB · EXEDownload ↓ Windows32-bit · x867.3 MB · EXEDownload ↓ Linux64-bit · x86_646.7 MB · ELFDownload ↓ Linux32-bit · x865.9 MB · ELFDownload ↓ macOS64-bit · Intel5.1 MB · Mach-ODownload ↓

For the commands in this guide, rename the downloaded Windows executable to aralez.exe or the Linux executable to aralez.

i

macOS build

The published macOS binary is an Intel (x86_64) build and runs under Rosetta 2 on Apple Silicon. Collection uses the POSIX walker, since System Integrity Protection blocks raw device access. Grant Full Disk Access to the invoking terminal, or TCC-protected artifacts are skipped silently.

Requirements

Rust toolchain with Cargo. The repository notes rustc 1.91.1 or newer for the AWS S3 dependency set.
Internet access during the first Windows build if the Sysinternals archive is not already present in tools/. Offline builds skip failed downloads.
Building a Windows binary from Linux additionally needs MinGW, because build.rs invokes x86_64-w64-mingw32-windres to compile the icon and manifest resources and panics if it is absent: sudo apt install mingw-w64. Native Windows builds use the winres crate instead and need nothing extra.

Build from source

!

Create config/config.yml first

No config.yml is committed — .gitignore excludes config/* apart from the three *.template files. build.rs resolves CONFIG_FILE (default config.yml) inside config/ and exits with Error: Configuration file 'config/config.yml' not found. if it is missing, so a fresh clone will not build until you copy a template.

PowerShell

git clone https://github.com/abaghinyan/Aralez.git
cd Aralez

# Required: no config.yml ships with the repository
copy config\config_windows.yml.template config\config.yml

cargo build --release
# -> target\release\aralez.exe

bash

git clone https://github.com/abaghinyan/Aralez.git
cd Aralez

# Required: no config.yml ships with the repository
cp config/config_linux.yml.template config/config.yml   # or config_macos.yml.template

cargo build --release
# -> target/release/aralez

Cross-compiled builds land under target/<target-triple>/release/ instead.

Build recipes

bash

# Minimal collector
cargo build --release

# S3 / MinIO transport
cargo build --release --features upload-s3

# SFTP transport
cargo build --release --features upload-sftp

# Every upload transport
cargo build --release --features upload

# Windows external tools + every upload transport
cargo build --release --features "extended-tools,upload"

Cargo feature reference

Feature	Adds	Notes
`extended-tools`	Extended Windows tool embedding	Currently gates WinPmem download/embedding.
`memdump`	Memory-dump capability	Includes `extended-tools`; the default Windows template keeps the memory task disabled.
`upload-s3`	AWS SDK + Tokio	Required for AWS S3 and MinIO.
`upload-sftp`	libssh2 binding	Supports password, key-file, or SSH-agent authentication via YAML.
`upload-smb`	Feature marker	SMB module is compiled in; Unix hosts call the external `smbclient`.
`upload`	All upload features	Convenience aggregate for S3, SFTP, and SMB.

Build with a different default profile

The build script reads CONFIG_FILE, resolves it inside config/, and copies it to config/.config.yml before compiling.

PowerShell

# File must exist under config\
$env:CONFIG_FILE = "config_windows.yml.template"
cargo build --release

bash

# File must exist under config/
CONFIG_FILE=config_linux.yml.template cargo build --release

!

Build script target limitation

At v0.11.0, build.rs recognizes x86 and x86_64 target triples. An aarch64 target reaches the unsupported-architecture panic even though macOS collection code exists. Test your target toolchain before field deployment.

Re-profile an existing executable

The --change_config command validates YAML and writes a new executable, leaving the source binary unchanged.

PowerShell

aralez.exe --change_config config\custom.yml aralez_custom.exe
aralez_custom.exe --show_config

bash

sudo aralez --change_config config/custom.yml aralez_custom
sudo aralez_custom --show_config

NextCollection model→