Unable to open/include a YARA file - python

I created a script that analyzes files based on yara rules ( the yara are the ones from this repository https://github.com/Yara-Rules/rules). My script import a yara file that include all other rules.When i try to compile it, i receive a syntax error: "can't open include file: rules_for_files\Antidebug_AntiVM_index.yar", pointing me to one of the rules. I tried to exclude it but it continue points to others.
I tried to use different versions of python: 1.i used python2.7 and i received the mentioned error in both case when i use a binary string/raw string. About python 3.5 when i mentioned a binary string like the one from my code sample, the interpreter broke/reset(in case i use a GUI). How can i resolve this? Thank you.
rules = yara.compile(filepaths={
"malware_set1 rules": b'C:/Users/g_bondrila/Desktop/phishme/functionalitati/yararules/importyara.yar'})
def yara_match(file_path, rules=rules):
try:
matches = rules.match(file_path, timeout=60)
return matches
#except TimeoutError:
# print("the time is running out")
except:
print("something")

Try giving the directory path as below:
"C:\\Users\\g_bondrila\\Desktop\\phishme\\functionalitati\\yararules\\importyara.yar"
Since Python doesn't reads single slash for a path in windows.

Related

ValueError: need more than 0 values to unpack (Python 2)

I am trying to replicate another researcher's findings by using the Python file that he added as a supplement to his paper. It is the first time I am diving into Python, so the error might be extremely simple to fix, yet after two days I haven't still. For context, in the Readme file there's the following instruction:
"To run the script, make sure Python2 is installed. Put all files into one folder designated as “cf_dir”.
In the script I get an error at the following lines:
if __name__ == '__main__':
cf_dir, cf_file, cf_phys_file = sys.argv[1:4]
os.chdir(cf_dir)
cf = pd.read_csv(cf_file)
cf_phys = pd.read_csv(cf_phys_file)
ValueError: need more than 0 values to unpack
The "cf_file" and "cf_phys_file" are two major components of all files that are in the one folder named "cf_dir". The "cf_phys_file" relates only to two survey question's (Q22 and Q23), and the "cf_file" includes all other questions 1-21. Now it seems that the code is meant to retrieve those two files from the directory? Only for the "cf_phys_file" the columns 1:4 are needed. The current working directory is already set at the right location.
The path where I located "cf_dir" is as follows:
C:\Users\Marc-Marijn Ossel\Documents\RSM\Thesis\Data\Suitable for ML\Data en Artikelen\Per task Suitability for Machine Learning score readme\cf_dir
Alternative option in readme file,
In the readme file there's this option, but also here I cannot understand how to direct the path to the right location:
"Run the following command in an open terminal (substituting for file names
below): python cfProcessor_AEAPnP.py cf_dir cf_file cf_phys_file task_file jobTaskRatingFile
jobDataFile OESfile
This should generate the data and plots as necessary."
When I run that in "Command Prompt", I get the following error, and I am not sure how to set the working directory correctly.
- python: can't open file 'cfProcessor_AEAPnP.py': [Errno 2] No such file or directory
Thanks for the reading, and I hope there's someone who could help me!
Best regards & stay safe out there during Corona!!
Marc
cf_dir, cf_file, cf_phys_file = sys.argv[1:4]
means, the python file expects few arguments when called.
In order to run
python cfProcessor_AEAPnP.py cf_dir cf_file cf_phys_file task_file jobTaskRatingFile jobDataFile OESfile
the command prompt should be in that folder.
So, open command prompt and type
cd path_to_the_folder_where_ur_python_file_is_located
Now, you would have reached the path of the python file.
Also, make sure you give full path in double quotes for the arguments.

NCO/pynco: ncea can't find files from within Python

I am trying to run ncea from within python to make monthly averages from daily files over many years of data.
The command:
ncea -v analysed_sst,sea_ice_fraction /mnt/r01/data/goes-poes_ghrsst/daily/200301*.nc 200301-gp-monthly.nc
runs fine in the terminal.
But in Python, I get the following error:
call(["ncea","-v","analysed_sst,sea_ice_fraction","/mnt/r01/data/goes-poes_ghrsst/daily/200301*.nc",monthly_file])
ncea: ERROR file /mnt/r01/data/goes-poes_ghrsst/daily/200301*.nc neither exists locally nor matches remote filename patterns
I also tried:
nco.ncea(input="/mnt/r01/data/goes-poes_ghrsst/daily/200301*.nc",output=monthly_file).variables['analysed_sst','sea_ice_fraction']
and get the same error.
I can't figure out if this is an NCO problem or a Python thing.
I get the same error when I use only two files to see if the issue comes from the wildcard.
For example:
input_string="/mnt/r01/data/goes-poes_ghrsst/daily/20030201000000-STAR-L4_GHRSST-SSTfnd-Geo_Polar_Blended_Night-GLOB-v02.0-fv01.0-0-360.nc /mnt/r01/data/goes-poes_ghrsst/daily/20030202000000-STAR-L4_GHRSST-SSTfnd-Geo_Polar_Blended_Night-GLOB-v02.0-fv01.0-0-360.nc"
call(["ncea","-v","analysed_sst,sea_ice_fraction",input_string,monthly_file])
ncea: ERROR file /mnt/r01/data/goes-poes_ghrsst/daily/20030201000000-STAR-L4_GHRSST-SSTfnd-Geo_Polar_Blended_Night-GLOB-v02.0-fv01.0-0-360.nc,/mnt/r01/data/goes-poes_ghrsst/daily/20030202000000-STAR-L4_GHRSST-SSTfnd-Geo_Polar_Blended_Night-GLOB-v02.0-fv01.0-0-360.nc neither exists locally nor matches remote filename patterns
I can't figure out what the syntax should be.
I get the same error if I do:
input_string="file1,file2"
input_string="file1 file2"
input_string="file1\ file2"
And if I try a list instead, like what glob.glob would return:
input_string=["file1","file2"]
I get:
TypeError: expected str, bytes or os.PathLike object, not list
Thanks!
So after finding this question: Using all elements of a list as argument to a system command (netCDF operator) in a python code
I finally figured it out:
input_string="/mnt/r01/data/goes-poes_ghrsst/daily/200301*.nc"
monthly_file="200301-gp-monthly.nc"
list1=['ncea','-v','analysed_sst,sea_ice_fraction']
list2=glob.glob(input_string)
command=list1+list2+[monthly_file]
subprocess.run(command)

Windows Python2.7 path parsing error

I'm attempting to use the python 010 editor template parser
The doc specifically states (to get started):
import pfp
pfp.parse(data_file="C:\path2File\file.SWF",template_file="C:\path2File\SWFTemplate.bt")
However, it throws:
RuntimeError: Unable to invoke 'cpp'. Make sure its path was passed correctly
Original error: [Error 2] The system cannot find the file specified
I've tried everything, from using raw strings:
df = r"C:\path2File\file.swf"
tf = r"C:\path2File\SWFTemplate.bt"
To single and then double '\'s or '/'s in the string. However, it keeps throwing the above error message.
I checked the files are in the path and ensured everything is properly spelled, case sensitively.
To test my paths, I've used the windows "type" (equiv to *nix strings) and passed the strings as args in a subprocess.Popen which worked.
The problem is that it's trying to invoke a C++ compiler: cpp and you don't have one.
You'll need to install one, or make sure that your PATH has a cpp.exe on it somewhere.

Playing Audio with subprocess.call in Python

I wanted to play a .wav file, without using external modules, and i read i could do that using this:
def play(audio_file_path):
subprocess.call(["ffplay", "-nodisp", "-autoexit", /Users/me/Downloads/sample.wav])
I however get:
SyntaxError: invalid syntax
If i use os.path.realpath to get the absolute path of the file, i get just the same thing. (The path i see at get info)
Environment is OSX, Python 2.7
Can someone tell me what i am doing wrong? I am new to Python (and to Programming).
There are multiple problems.
Indentation
Code inside the function should be indented, to show that it is part of the function
File name should be in a quotes
It should be a string
It should be:
def play(audio_file_path):
subprocess.call(["ffplay", "-nodisp", "-autoexit", "/Users/me/Downloads/sample.wav"])

os.listdir can't see my directory

I am working on a python script that installs an 802.1x certificate on a Windows 8.1 machine. This script works fine on Windows 8 and Windows XP (haven't tried it on other machines).
I have isolated the issue. It has to do with clearing out the folder
"C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptURLCache\Content"
The problem is that I am using the module os and the command listdir on this folder to delete each file in it. However, listdir errors, saying the folder does not exist, when it does indeed exist.
The issue seems to be that os.listdir cannot see the LocalLow folder. If I make a two line script:
import os
os.listdir("C:\Windows\System32\config\systemprofile\AppData")
It shows the following result:
['Local', 'Roaming']
As you can see, LocalLow is missing.
I thought it might be a permissions issue, but I am having serious trouble figuring out what a next step might be. I am running the process as an administrator from the command line, and it simply doesn't see the folder.
Thanks in advance!
Edit: changing the string to r"C:\Windows\System32\config\systemprofile\AppData", "C:\Windows\System32\config\systemprofile\AppData", or C:/Windows/System32/config/systemprofile/AppData" all produce identical results
Edit: Another unusual wrinkle in this issue: If I manually create a new directory in that location I am unable to see it through os.listdir either. In addition, I cannot browse to the LocalLow or my New Folder through the "Save As.." command in Notepad++
I'm starting to think this is a bug in Windows 8.1 preview.
I encountered this issue recently.
I found it's caused by Windows file system redirector
and you can check out following python snippet
import ctypes
class disable_file_system_redirection:
_disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection
_revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection
def __enter__(self):
self.old_value = ctypes.c_long()
self.success = self._disable(ctypes.byref(self.old_value))
def __exit__(self, type, value, traceback):
if self.success:
self._revert(self.old_value)
#Example usage
import os
path = 'C:\\Windows\\System32\\config\\systemprofile\\AppData'
print os.listdir(path)
with disable_file_system_redirection():
print os.listdir(path)
print os.listdir(path)
ref : http://code.activestate.com/recipes/578035-disable-file-system-redirector/
You must have escape sequences in your path. You should use a raw string for file/directory paths:
# By putting the 'r' at the start, I make this string a raw string
# Raw strings do not process escape sequences
r"C:\path\to\file"
or put the slashes the other way:
"C:/path/to/file"
or escape the slashes:
# You probably won't want this method because it makes your paths huge
# I just listed it because it *does* work
"C:\\path\\to\\file"
I'm curious as to how you are able to list the contents with those two lines. You are using escape sequences \W, \S, \c, \s, \A in your code. Try escaping the back slash like this:
import os
os.listdir('C:\\Windows\\System32\\config\\systemprofile\\AppData')

Categories