Neo23x0 / Loki

Loki - Simple IOC and YARA Scanner
https://www.nextron-systems.com/compare-our-scanners/
GNU General Public License v3.0
3.4k stars 583 forks source link

Error while extracting the signature files #219

Closed eyaladmin closed 2 years ago

eyaladmin commented 2 years ago

Hi

I am using windows 11

And there is an issue with the signature update even when I try to take them with loki-upgrade command

c:\Program Files\Loki>loki-upgrader.exe --sigsonly --debug

LOKI UPGRADER

[INFO] Updating Signatures ... [INFO] Downloading https://github.com/Neo23x0/signature-base/archive/master.zip ... Traceback (most recent call last): File "\vboxsvr\workspace\Loki\loki-upgrader.py", line 90, in update_signatures File "http\client.py", line 471, in read File "http\client.py", line 614, in _safe_read http.client.IncompleteRead: IncompleteRead(2930480 bytes read, 410558 more expected) [ERROR] Error while extracting the signature files from the download package

What do you recommend to troubleshoot it?

Is there a way I can put the signature manually for the scan?

Thank you

Neo23x0 commented 2 years ago

It's most likely your AV or EDR blocking the extraction

eyaladmin commented 2 years ago

Hi I already excluded "c:\Program Files\Loki" any other path is also part of the operation, such as temp folder or such?

Neo23x0 commented 2 years ago

No. But it's your AV. I guess it's a module that checks HTTP/HTTPS traffic. It seems that the package download gets blocked.

eyaladmin commented 2 years ago

OK I will look for it, thanks Are there manual steps to update the signature by manually downloading the file and so on?

Neo23x0 commented 2 years ago

The manual process would also be blocked by your AV, I guess

Neo23x0 commented 2 years ago

You could try to download the whole signature-base repo as a ZIP package and then extract it into the program root folder

image

image

eyaladmin commented 2 years ago

Thanks for your help

the hash for the zip file is marked as a trojan but scanning inside the extracted folder, all hashes are fine.

And an unimported note, scanning shows 0.44.2 with 0.45

Not sure if this is because of the manual update or else

Screenshot loki0 45