I am attempting to try to install Onemon as an extra dependency and I am hitting the following error every time I try and run that dependency script:
2023-11-07 12:19:52,371 vmcloak.install INFO: Installing dependency: onemon version=no version/default
2023-11-07 12:19:52,440 vmcloak.install ERROR: 'DOS Header magic not found.'
Traceback (most recent call last):
File "/home/<>/venv/vmcloak/vmcloak/install.py", line 113, in do_install
self.dependency.run()
File "/home/<>/venv/vmcloak/vmcloak/dependencies/onemon.py", line 136, in run
winload = self.patch_winload(winload)
File "/home/<>/venv/vmcloak/vmcloak/dependencies/onemon.py", line 34, in patch_winload
pe1 = pefile.PE(data=blob, fast_load=True)
File "/home/<>/venv/lib/python3.8/site-packages/pefile.py", line 1754, in init
self.parse(name, data, fast_load)
File "/home/<>/venv/lib/python3.8/site-packages/pefile.py", line 1847, in parse
raise PEFormatError('DOS Header magic not found.')
pefile.PEFormatError: 'DOS Header magic not found.'
2023-11-07 12:19:52,461 vmcloak.install ERROR: Failed to install dependency 'onemon'. Unexpected failure during install of 'onemon'. 'DOS Header magic not found.'
2023-11-07 12:19:52,461 vmcloak.install INFO: No more dependencies to install
2023-11-07 12:19:52,461 vmcloak.install DEBUG: Shutting down vm
2023-11-07 12:19:52,462 vmcloak.agent DEBUG: Executing command in VM: shutdown -s -t 1
2023-11-07 12:20:06,737 vmcloak.platforms.qemu INFO: Cleanup VM cuckoo
I am assuming it is trying to check the file winload. I have not been able to get to the file yet inside the vm to check it but I did see there is a similar file inside the folder
test/files/winload.0x4ce7929c.exe
Is this file something that can be dropped to the vm if the one inside is bad to try and fix this issue?
I am attempting to try to install Onemon as an extra dependency and I am hitting the following error every time I try and run that dependency script:
I am assuming it is trying to check the file winload. I have not been able to get to the file yet inside the vm to check it but I did see there is a similar file inside the folder
Is this file something that can be dropped to the vm if the one inside is bad to try and fix this issue?