Neo23x0/Loki

On Loki scan start, multiple unterminated regular expression messages occur

g33k247 opened this issue · 4 comments

g33k247 commented

Getting a bunch of these messages when starting a scan:

line 1126, in initialize_yara_rules yara.SyntaxError: line 22: unterminated regular expression

On Windows 11, executing from PowerShell. Once Loki gets past these issues, the scan continues and completes as expected.

Neo23x0 commented

The signatures seem to be okay. It's most likely an AV that deleted part of a signature set before the initialisation.

  • 👍1
g33k247 commented

Here's an example of the errors I'm seeing:

Traceback (most recent call last):
  File "\\vboxsvr\workspace\Loki\loki.py", line 1126, in initialize_yara_rules
yara.SyntaxError: line 22: unterminated regular expression
Traceback (most recent call last):
  File "\\vboxsvr\workspace\Loki\loki.py", line 1126, in initialize_yara_rules
yara.SyntaxError: line 22: unterminated regular expression
Traceback (most recent call last):
  File "\\vboxsvr\workspace\Loki\loki.py", line 1126, in initialize_yara_rules
yara.SyntaxError: line 22: unterminated regular expression
Traceback (most recent call last):
  File "\\vboxsvr\workspace\Loki\loki.py", line 1126, in initialize_yara_rules
yara.SyntaxError: line 22: unterminated regular expression
Traceback (most recent call last):
  File "\\vboxsvr\workspace\Loki\loki.py", line 1126, in initialize_yara_rules
yara.SyntaxError: line 22: unterminated regular expression
Traceback (most recent call last):
  File "\\vboxsvr\workspace\Loki\loki.py", line 1126, in initialize_yara_rules
yara.SyntaxError: line 22: unterminated regular expression
Traceback (most recent call last):
  File "\\vboxsvr\workspace\Loki\loki.py", line 1126, in initialize_yara_rules
yara.SyntaxError: line 22: unterminated regular expression
Traceback (most recent call last):
  File "\\vboxsvr\workspace\Loki\loki.py", line 1126, in initialize_yara_rules
yara.SyntaxError: line 22: unterminated regular expression
Neo23x0 commented

I cannot reproduce the error with the current version and the current rule set.

Neo23x0 commented

It's also a shit way to report errors not indicating the version number of the software, which OS, the command line, if customer rules are used etc.