📦 How to build self-contained executables
The downloads need the .NET runtime installed. If you would rather not install it, on a forensic workstation or a machine you don't control for example, you can build any command line tool yourself as one self-contained file with the runtime inside it.
The tradeoff
The normal .NET 10 MFTECmd is 2.6 MB in 3 files and needs the .NET 10 runtime. Built self-contained, it is one 72.6 MB file that needs nothing else. Same tool, same output.
🧰 What you need
- git
- The .NET 10 SDK (the SDK, not only the runtime)
🛠️ Steps
This example builds MFTECmd. Every command line tool works the same way.
-
Clone the repository. Open a shell (PowerShell, for example), go to where you want it (here
C:\Temp) and run:git clone https://github.com/EricZimmerman/MFTECmd.git
-
Go into the repository:
cd C:\Temp\MFTECmd -
Build it. Pick the system it will run on:
dotnet publish -f net10.0 -r win-x64 -p:PublishSingleFile=true --self-contained true -p:IncludeNativeLibrariesForSelfExtract=truedotnet publish -f net10.0 -r linux-x64 -p:PublishSingleFile=true --self-contained true -p:IncludeNativeLibrariesForSelfExtract=truedotnet publish -f net10.0 -r osx-arm64 -p:PublishSingleFile=true --self-contained true -p:IncludeNativeLibrariesForSelfExtract=true
-
Find the result in the
publishfolder, for WindowsC:\Temp\MFTECmd\MFTECmd\bin\Release\net10.0\win-x64\publish:
-
✅ Test it before you rely on it: run it with
--help, then on some test data.
The screenshots show .NET 9 (net9.0); use the net10.0 commands and paths above.
Good to know
- Repeat the steps for every tool you want; each one is built from its own repository.
- Some tools only run on Windows whatever you build them for: SrumECmd and SumECmd (they use Windows' ESE database engine) and VSCMount.
IncludeNativeLibrariesForSelfExtract=trueputs native libraries (the SQLite files of AmcacheParser, WxTCmd and SQLECmd) inside the file, and .NET extracts them to a temporary folder when the tool runs. Leave that option out to keep them as files next to the tool instead.