SQLECmd.dll Unable to Load SQLite.interop.dll on Linux Ubuntu

[TEGDV]

SQLECmd version # SQLECmd.dll 1.0.0.0

Describe the bug Basically the DLL not runs correctly on Ubuntu or Debian Linux System Debian 4.9.303-1 (2022-03-07) x86_64 GNU/Linux

Unhandled exception: System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation.
 ---> System.DllNotFoundException: Unable to load shared library 'SQLite.Interop.dll' or one of its dependencies. In order to help diagnose loading problems, consider setting the LD_DEBUG environment variable: libSQLite.Interop.dll: cannot open shared object file: No such file or directory
   at System.Data.SQLite.UnsafeNativeMethods.sqlite3_config_none(SQLiteConfigOpsEnum op)
   at System.Data.SQLite.SQLite3.StaticIsInitialized()
   at System.Data.SQLite.SQLiteLog.PrivateInitialize(String className)
   at System.Data.SQLite.SQLiteLog.Initialize(String className)
   at System.Data.SQLite.SQLiteConnection..ctor(String connectionString, Boolean parseViaFramework)
   at System.Data.SQLite.SQLiteConnection..ctor(String connectionString)
   at ServiceStack.OrmLite.Sqlite.SqliteOrmLiteDialectProvider.CreateConnection(String connectionString)
   at ServiceStack.OrmLite.Sqlite.SqliteOrmLiteDialectProviderBase.CreateConnection(String connectionString, Dictionary`2 options)
   at ServiceStack.OrmLite.OrmLiteConfig.ToDbConnection(String dbConnectionStringOrFilePath, IOrmLiteDialectProvider dialectProvider)
   at ServiceStack.OrmLite.OrmLiteConnection.get_DbConnection()
   at ServiceStack.OrmLite.OrmLiteConnection.Open()
   at SQLECmd.Program.ProcessFile(String fileName, Boolean hunt, Boolean dedupe, String csv)
   at SQLECmd.Program.DoWork(String f, String d, String csv, String json, Boolean dedupe, Boolean hunt, String maps, Boolean sync, Boolean debug, Boolean trace)
   --- End of inner exception stack trace ---
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Span`1& arguments, Signature sig, Boolean constructor, Boolean wrapExceptions)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at System.Delegate.DynamicInvokeImpl(Object[] args)
   at System.Delegate.DynamicInvoke(Object[] args)
   at System.CommandLine.NamingConventionBinder.ModelBindingCommandHandler.InvokeAsync(InvocationContext context) in /_/src/System.CommandLine.NamingConventionBinder/ModelBindingCommandHandler.cs:line 87
   at System.CommandLine.Invocation.InvocationPipeline.<>c__DisplayClass4_0.<<BuildInvocationChain>b__0>d.MoveNext() in /_/src/System.CommandLine/Invocation/InvocationPipeline.cs:line 58
--- End of stack trace from previous location ---
   at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass22_0.<<UseParseErrorReporting>b__0>d.MoveNext() in /_/src/System.CommandLine/Builder/CommandLineBuilderExtensions.cs:line 611
--- End of stack trace from previous location ---
   at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass15_0.<<UseHelp>b__0>d.MoveNext() in /_/src/System.CommandLine/Builder/CommandLineBuilderExtensions.cs:line 473
--- End of stack trace from previous location ---
   at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass26_0.<<UseVersionOption>b__0>d.MoveNext() in /_/src/System.CommandLine/Builder/CommandLineBuilderExtensions.cs:line 725
--- End of stack trace from previous location ---
   at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass24_0.<<UseTypoCorrections>b__0>d.MoveNext() in /_/src/System.CommandLine/Builder/CommandLineBuilderExtensions.cs:line 672
--- End of stack trace from previous location ---
   at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c.<<UseSuggestDirective>b__23_0>d.MoveNext() in /_/src/System.CommandLine/Builder/CommandLineBuilderExtensions.cs:line 646
--- End of stack trace from previous location ---
   at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass21_0.<<UseParseDirective>b__0>d.MoveNext() in /_/src/System.CommandLine/Builder/CommandLineBuilderExtensions.cs:line 586
--- End of stack trace from previous location ---
   at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c.<<UseDebugDirective>b__8_0>d.MoveNext() in /_/src/System.CommandLine/Builder/CommandLineBuilderExtensions.cs:line 285
--- End of stack trace from previous location ---
   at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c.<<RegisterWithDotnetSuggest>b__7_0>d.MoveNext() in /_/src/System.CommandLine/Builder/CommandLineBuilderExtensions.cs:line 236
--- End of stack trace from previous location ---
   at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass11_0.<<UseExceptionHandler>b__0>d.MoveNext() in /_/src/System.CommandLine/Builder/CommandLineBuilderExtensions.cs:line 377

[salty4n6]

This does work, but you need to be running it with sudo.

sans@siftworkstation: /cases $ sudo dotnet /opt/zimmermantools/net6/SQLECmd/SQLECmd.dll -d /mnt/windows_mount --hunt --csv /cases/sql1 SQLECmd version 1.0.0.0

Author: Eric Zimmerman (saericzimmerman@gmail.com) https://github.com/EricZimmerman/SQLECmd Command line: -d /mnt/windows_mount --hunt --csv /cases/sql1

Maps loaded: 72 Looking for files in /mnt/windows_mount

However, it just sits here. I haven't given it hours yet to run but it's WAY SLOWER than looking at the same VMDK on Windows.

~Salty

[AndrewRathbun]

This does work, but you need to be running it with sudo.

sans@siftworkstation: /cases $ sudo dotnet /opt/zimmermantools/net6/SQLECmd/SQLECmd.dll -d /mnt/windows_mount --hunt --csv /cases/sql1 SQLECmd version 1.0.0.0

Author: Eric Zimmerman (saericzimmerman@gmail.com) https://github.com/EricZimmerman/SQLECmd Command line: -d /mnt/windows_mount --hunt --csv /cases/sql1

Maps loaded: 72 Looking for files in /mnt/windows_mount

However, it just sits here. I haven't given it hours yet to run but it's WAY SLOWER than looking at the same VMDK on Windows.

~Salty

Is the SQLite.Interop.dll file present in your scenario? That appears to be what the issue is in the original post.

[salty4n6]

For me, this is part of a script that I'm running with sudo permissions, which gives SQLite.Interop.dll root root for ownership. I understand @TEGDV might have something else going on, but it does work.

For me, speed is the issue with using SQLECmd on Ubuntu. I haven't given it enough time to run on Ubuntu to know if it's actually working or just sitting there.

~Salty