search

mandiant / GoReSym

Go symbol recovery tool
MIT License
498 stars 62 forks source link

GoReSym binary is linked with libyara.so.10 on Linux #23

Closed xusheng6 closed 11 months ago

xusheng6 commented 1 year ago

When I tried to run it on Ubuntu 22.04, I get an error message that libyara.so.10 is missing. I installed the libyara-dev with apt, but it did not fix the problem, since the one that comes is libyara.so.8. Manually building the libyara following this guide https://yara.readthedocs.io/en/stable/gettingstarted.html generates a libyara.so.10 and it works fine.

Does GoReSym actually require the latest features of yara? Could it be built with an earlier version of it so that it runs out of the box on Ubuntu? Or, since yara comes with a quite permissive license (https://github.com/VirusTotal/yara/blob/master/COPYING), could GoReSym statically link with libyara.so.10?

stevemk14ebr commented 1 year ago

We use very basic yara features just to do signature scanning, so it's fine to link any version if it's compatible with go-yara. I did attempt to statically link, though if you're seeing issues I guess i've done it wrong:

https://github.com/mandiant/GoReSym/blob/95f27bbcd672d8189e350bee04d44e8fca06cb96/build_all.sh#L22-L23

xusheng6 commented 1 year ago

We use very basic yara features just to do signature scanning, so it's fine to link any version if it's compatible with go-yara. I did attempt to statically link, though if you're seeing issues I guess i've done it wrong:

https://github.com/mandiant/GoReSym/blob/95f27bbcd672d8189e350bee04d44e8fca06cb96/build_all.sh#L22-L23

Yeah, the libyara is not statically linked

stevemk14ebr commented 11 months ago

Do you have any suggestions on how to correctly statically link the library?

Maybe related to this https://github.com/hillu/go-yara/issues/40