VirusTotal / yara-python

The Python interface for YARA
http://virustotal.github.io/yara/
Apache License 2.0
646 stars 179 forks source link

missing libpcre.so.3 #204

Closed imb4dm4n closed 2 years ago

imb4dm4n commented 2 years ago

I have installed yara-python for my server. In the python3 shell, I tried to import yara. It failed with the following messages. If I install yara module, and import yara again. It show that libpcre.so.3 is missing. I google a lot about this problem but can't find any clue. Somebody help me pls ~ ` [user_name@vm18 themis]$ python3 Python 3.6.8 (default, Aug 6 2021, 10:05:57) [GCC 4.8.5 20150623 (Red Hat 4.8.5-39)] on linux Type "help", "copyright", "credits" or "license" for more information.

import yara Failed to import '/usr/local/python3/lib/libyara.so' PATH = =/usr/lib64/qt-3.3/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/home/user_name/.dotnet/tools:/home/user_name/anaconda3/bin:/home/user_name/.local/bin:/home/user_name/bin;/usr/local/python3/lib Traceback (most recent call last): File "", line 1, in File "/home/user_name/.local/lib/python3.6/site-packages/yara/init.py", line 7, in from yara.rules import compile File "/home/user_name/.local/lib/python3.6/site-packages/yara/rules.py", line 17, in from yara.libyara_wrapper import * File "/home/user_name/.local/lib/python3.6/site-packages/yara/libyara_wrapper.py", line 315, in libyaradll = cdll.LoadLibrary(library) File "/usr/local/python3/lib/python3.6/ctypes/init.py", line 426, in LoadLibrary return self._dlltype(name) File "/usr/local/python3/lib/python3.6/ctypes/init.py", line 348, in init self._handle = _dlopen(self._name, mode) OSError: /usr/local/python3/lib/libyara.so: cannot open shared object file: No such file or directory exit() [user_name@vm18 themis]$ pip3 list|grep yara yara-python 4.2.0 yara-python-dex 1.0.1`

imb4dm4n commented 2 years ago

In addition, there are libpcre.so.2 and libpcre.so.1 on my server.

plusvic commented 2 years ago

Which steps did you follow for installing yara-python. The libpcre.so was used in very old versions of YARA, but is not used anymore.

wxsBSD commented 2 years ago

/home/user_name/.local/lib/python3.6/site-packages/yara/init.py that path makes me think you did pip3 install yara which (last time I checked) was not the same as the yara-python module.

imb4dm4n commented 2 years ago

/home/user_name/.local/lib/python3.6/site-packages/yara/init.py that path makes me think you did pip3 install yara which (last time I checked) was not the same as the yara-python module. I think I installed the right yara.... $ pip3 list|grep yara yara-python 4.2.0 yara-python-dex 1.0.1

imb4dm4n commented 2 years ago

Which steps did you follow for installing yara-python. The libpcre.so was used in very old versions of YARA, but is not used anymore.

I just install yara-python. If I instlal yara, and import yara, I got this: `[user@vm18 themis]$ python3 Python 3.6.8 (default, Aug 6 2021, 10:05:57) [GCC 4.8.5 20150623 (Red Hat 4.8.5-39)] on linux Type "help", "copyright", "credits" or "license" for more information.

import yara Failed to import '/usr/local/python3/lib/libyara.so' PATH = =/usr/lib64/qt-3.3/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/home/user/.dotnet/tools:/home/user/anaconda3/bin:/home/user/.local/bin:/home/user/bin;/usr/local/python3/lib Traceback (most recent call last): File "", line 1, in File "/home/user/.local/lib/python3.6/site-packages/yara/init.py", line 7, in from yara.rules import compile File "/home/user/.local/lib/python3.6/site-packages/yara/rules.py", line 17, in from yara.libyara_wrapper import * File "/home/user/.local/lib/python3.6/site-packages/yara/libyara_wrapper.py", line 315, in libyaradll = cdll.LoadLibrary(library) File "/usr/local/python3/lib/python3.6/ctypes/init.py", line 426, in LoadLibrary return self._dlltype(name) File "/usr/local/python3/lib/python3.6/ctypes/init.py", line 348, in init self._handle = _dlopen(self._name, mode) OSError: /usr/local/python3/lib/libyara.so: cannot open shared object file: No such file or directory`

plusvic commented 2 years ago

As @wxsBSD said you have this installed: https://github.com/mjdorma/yara-ctypes. That python module is also called yara, and is colliding with yara-python. You may have both installed, but yara-ctypes is taking precedence.

imb4dm4n commented 2 years ago

@plusvic @wxsBSD Thanks a lot. Problem solved! I should look careful when I install this model.

KTibow commented 2 years ago

I'm stuck on this too. I've tried building it myself to no avail.

python
Python 3.10.4 (main, Mar 25 2022, 00:00:00) [GCC 12.0.1 20220308 (Red Hat 12.0.1-0)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import yara
Failed to import '/usr/lib/libyara.so'
PATH = /home/kendell/.cargo/bin:/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin;/usr/lib
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/kendell/.local/lib/python3.10/site-packages/yara/__init__.py", line 7, in <module>
    from yara.rules import compile
  File "/home/kendell/.local/lib/python3.10/site-packages/yara/rules.py", line 17, in <module>
    from yara.libyara_wrapper import *
  File "/home/kendell/.local/lib/python3.10/site-packages/yara/libyara_wrapper.py", line 315, in <module>
    libyaradll = cdll.LoadLibrary(library)
  File "/usr/lib64/python3.10/ctypes/__init__.py", line 452, in LoadLibrary
    return self._dlltype(name)
  File "/usr/lib64/python3.10/ctypes/__init__.py", line 374, in __init__
    self._handle = _dlopen(self._name, mode)
OSError: /usr/lib/libyara.so: cannot open shared object file: No such file or directory
>>> exit()