Step 1. Download SandSifter zipfile and extract to a folder. Step 2. Download Linux Mint ISO Step 3. Burn Linux Mint ISO to DVD (Right click on file and choose burn to disc). Step 4. Boot Linux Mint ISO from DVD Step 5. Open command line from start menu Step 6. Install capstone disassembler software with following command: sudo apt-get install libcapstone3 Step 7. Navigate to SandSifter software folder via “Home” GUI interface. Step 8. Right click white space/empty window and choose open in terminal. Step 9. Install standard C library software with following command: sudo apt-get install libc6-dev Step 10. Install capstone disassembler dev software with following command: sudo apt-get install libcapstone-dev Step 11. Build sandsifter software with following command (in it’s folder): make If all went well output will look as follows: cc -c injector.c -o injector.o -Wall injector.c:321:93: warning: excess elements in array initializer 00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}, .len ^ injector.c:321:93: note: (near initialization for ‘total_range.start.bytes’) injector.c:322:91: warning: excess elements in array initializer ff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff}, .len ^ injector.c:322:91: note: (near initialization for ‘total_range.end.bytes’) cc injector.o -O3 -Wall -l:libcapstone.a -o injector -pthread Additional steps are required to make it work/run: Step 12. install pip and setup tools with following commands: sudo apt install python-pip sudo pip install --upgrade pip sudo pip install setuptools Step 14 install capstone (this will take a while): sudo pip install capstone Step 15. Run sandsifter software with following command while in the sandsifter folder with the terminal window: sudo ./sifter.py --unk --dis --len --sync --tick -- -P1 -t It works… cool ! :) =D Resize the terminal window for more information on screen Step 16. Summarize log files Before running this command make the terminal window bigger so that the script doesn't crash. ./summarize.py data/log Now the day after I have created a script file to automate the process so avoid all this nasty copy & pasting of commands. To run the bash script file type the following into the terminal window (avoid using capital letters): bash ./run.sh