polymorf / findcrypt-yara

IDA pro plugin to find crypto constants (and more)
BSD 3-Clause "New" or "Revised" License
1.36k stars 243 forks source link

libyara.dll not import in python38 #42

Closed scylamb closed 1 year ago

scylamb commented 1 year ago
Failed to import 'C:\Users\Win10Tools\Desktop\Misc\Re\IDA\IDA_Pro_7.7\python38\DLLs\libyara.dll'
PATH = C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Program Files\Python\Python38\Scripts\;C:\Program Files\Python\Python38\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\Git\cmd;C:\Program Files\Microsoft VS Code\bin;C:\Program Files\Python\Python27\Scripts;C:\Users\Win10Tools\AppData\Local\Microsoft\WindowsApps;;C:\Users\Win10Tools\Desktop\Misc\Re\IDA\IDA_Pro_7.7\python38\DLLs
C:\Users\Win10Tools\Desktop\misc\Re\IDA\IDA_Pro_7.7\plugins\findcrypt3.py: Could not find module 'C:\Users\Win10Tools\Desktop\Misc\Re\IDA\IDA_Pro_7.7\python38\DLLs\libyara.dll' (or one of its dependencies). Try using the full path with constructor syntax.
Traceback (most recent call last):
  File "C:\Users\Win10Tools\Desktop\misc\Re\IDA\IDA_Pro_7.7\python\3\ida_idaapi.py", line 580, in IDAPython_ExecScript
    exec(code, g)
  File "C:/Users/Win10Tools/Desktop/misc/Re/IDA/IDA_Pro_7.7/plugins/findcrypt3.py", line 9, in <module>
    import yara
  File "C:\Users\Win10Tools\AppData\Roaming\Python\Python38\site-packages\yara\__init__.py", line 7, in <module>
    from yara.rules import compile
  File "C:\Users\Win10Tools\AppData\Roaming\Python\Python38\site-packages\yara\rules.py", line 17, in <module>
    from yara.libyara_wrapper import *
  File "C:\Users\Win10Tools\AppData\Roaming\Python\Python38\site-packages\yara\libyara_wrapper.py", line 315, in <module>
    libyaradll = cdll.LoadLibrary(library)
  File "ctypes\__init__.py", line 451, in LoadLibrary
  File "ctypes\__init__.py", line 373, in __init__
FileNotFoundError: Could not find module 'C:\Users\Win10Tools\Desktop\Misc\Re\IDA\IDA_Pro_7.7\python38\DLLs\libyara.dll' (or one of its dependencies). Try using the full path with constructor syntax.

However, the file exists under the path C:\Users\Win10Tools\Desktop\Misc\Re\IDA\IDA_Pro_7.7\python38\DLLs\libyara.dll

scylamb commented 1 year ago

Oh...,The Yara module in system python is not removed cleanly. Closing...

HydraDragonAntivirus commented 1 year ago

I solved this before I using pip install yara because pip install yara-python didn't support some pe things but on Linux pip install yara works. But now get same issue have no idea to solve that. I also didn't know is Windows version of yara suppor tsome import pe things.