3

I have installed cuckoo and all the dependencies and have also created VM using virtual box. I am getting an error "OSError: /usr/lib/libyara.so: cannot open shared object file: No such file or directory" whenever i try to run cuckoo.py using python

I have tried searching in all forums and also tested whether yara is installed properly. It seems to be working fine using terminal. Checked that libyara.so is present in /usr/local/lib and python or cuckoo is checking in /usr/lib/

Also tried updating local library using

sudo echo "/usr/local/lib" >> /etc/ld.so.conf sudo ldconfig

I have installed yara using tar ball. Have also used --enable-cuckoo --enable-magic args too.

Where might have I gone wrong?

Configuration of my system: Ubuntu 16.04; python 2.7; yara 3.4.0

user3009648
  • 31
  • 1
  • 1
  • 2

7 Answers7

6

Had a similar issue but mine was stored in /usr/local/lib/python2.7/dist-packages/usr/lib/libyara.so

Creating the soft-link to that Location solved the issue

*ln -s /usr/local/lib/python2.7/dist-packages/usr/lib/libyara.so /usr/lib/libyara.so*
anoopknr
  • 3,177
  • 2
  • 23
  • 33
RandomUser
  • 61
  • 1
  • 2
5

According to official documentation, It means that the loader is not finding the libyara library which is located in /usr/local/lib. In some Linux flavors the loader doesn’t look for libraries in this path by default, we must instruct him to do so by adding /usr/local/lib to the loader configuration file /etc/ld.so.conf:

sudo echo "/usr/local/lib" >> /etc/ld.so.conf
sudo ldconfig
Helton Wernik
  • 185
  • 2
  • 3
1

your script is looking for the lib in /usr/lib/libyara.so but you said the lib is in /usr/local/lib

i'd create as softlink to fix this.

ln -s /usr/local/lib/libyara.so /usr/lib/libyara.so

General Foch
  • 333
  • 1
  • 7
  • 1
    Thanks for the help. I had created soft link and tried. This time it is throwing error `"AttributeError: /usr/lib/libyara.so: undefined symbol: lookup_rule"` – user3009648 Dec 23 '16 at 12:01
  • I was also getting this error. Running `find / -name libyara.so` revealed two files: `/usr/lib/x86_64-linux-gnu/libyara.so` and `/usr/local/lib/python2.7/dist-packages/usr/lib/libyara.so`. Creating a symlink to the first resulted in the error. Creating a symlink to the second resulted in no error. – ben_re Aug 16 '18 at 12:40
  • makes sense. the first error it was looking for the library in the wrong place the second was a library mismatch which you solved by finding and creating the soft link to the second one. – General Foch Aug 17 '18 at 14:52
1

If soft link is not working

cp /usr/local/lib/python2.7/dist-packages/usr/lib/libyara.so /usr/lib/

deepanshu jain
  • 11
  • 1
0

I followed this link to resolve

https://www.pythonanywhere.com/forums/topic/29428/

apt list --installed |grep yara                                                                                                      

libyara4/kali-rolling,now 4.0.5-1 amd64 [installed,automatic]
python3-yara/kali-rolling,now 4.0.4-1 amd64 [installed,automatic]





apt remove python3-yara/kali-rolling  
apt remove libyara4/kali-rolling

This may be possibly caused due to multiple version of yara in system.

Yara started working well after this change.

R-JANA
  • 1,138
  • 2
  • 14
  • 30
0

You can create a virtual environment and install requirement.txt inside it, then complete the installation steps.

Adham Amiin
  • 809
  • 7
  • 5
0

Had the same problem. Seems to be two different packages.

The one I was looking for was yara-python instead of only yara.

Fixed it with:

$ python3 -m pip uninstall yara
$ python3 -m pip install yara-python
Nicolai Prebensen
  • 301
  • 1
  • 4
  • 10