search

williballenthin / python-vb

analysis of visual basic code
39 stars 9 forks source link

vb.analyzer failing to load keystone-engine #11

Closed habGegeben closed 5 years ago

habGegeben commented 5 years ago 
user$ python3 vb_info.py ../../../targetbinary.exe

WARNING:vb.analyzer:failed to load keystone-engine
project_description: TestName
[...]

keystone and the keystone-engine are installed for all python versions (2.7, 3.6, and 3.7). python3 --version is 3.6.7.

Project structure (imports, objects, controls, project info) for the VB binary are correctly parsed and output, but no decompiled code, as obviously the keystone-engine fails to load. Running python3 interpreter successfully imports keystone, so I'm not sure why this is failing when calling vb_info.py

habGegeben commented 5 years ago

Forgot to mention, this is on a linux machine.

williballenthin commented 5 years ago

interesting. i'm not sure why this is the case.

fortunately, python-vb doesn't actually use the assembler functionality from keystone - its just part of the analyzer class we use. i'd propose ignoring this warning for now.

habGegeben commented 5 years ago

It's possible that it's related to issue #386 in the keystone-engine, though I've had no success even after correcting it. I'll go ahead and close this issue if the assembler functionality isn't used.

williballenthin commented 5 years ago

ah, yes, i've had trouble with capstone/keystone in virtualenvs before. i think i fixed it by copying the .so into the appropriate directory, but i dont recall which one offhand.