On Loki scan start, multiple unterminated regular expression messages occur
g33k247 opened this issue · 4 comments
g33k247 commented
Getting a bunch of these messages when starting a scan:
line 1126, in initialize_yara_rules yara.SyntaxError: line 22: unterminated regular expression
On Windows 11, executing from PowerShell. Once Loki gets past these issues, the scan continues and completes as expected.
Neo23x0 commented
The signatures seem to be okay. It's most likely an AV that deleted part of a signature set before the initialisation.
g33k247 commented
Here's an example of the errors I'm seeing:
Traceback (most recent call last):
File "\\vboxsvr\workspace\Loki\loki.py", line 1126, in initialize_yara_rules
yara.SyntaxError: line 22: unterminated regular expression
Traceback (most recent call last):
File "\\vboxsvr\workspace\Loki\loki.py", line 1126, in initialize_yara_rules
yara.SyntaxError: line 22: unterminated regular expression
Traceback (most recent call last):
File "\\vboxsvr\workspace\Loki\loki.py", line 1126, in initialize_yara_rules
yara.SyntaxError: line 22: unterminated regular expression
Traceback (most recent call last):
File "\\vboxsvr\workspace\Loki\loki.py", line 1126, in initialize_yara_rules
yara.SyntaxError: line 22: unterminated regular expression
Traceback (most recent call last):
File "\\vboxsvr\workspace\Loki\loki.py", line 1126, in initialize_yara_rules
yara.SyntaxError: line 22: unterminated regular expression
Traceback (most recent call last):
File "\\vboxsvr\workspace\Loki\loki.py", line 1126, in initialize_yara_rules
yara.SyntaxError: line 22: unterminated regular expression
Traceback (most recent call last):
File "\\vboxsvr\workspace\Loki\loki.py", line 1126, in initialize_yara_rules
yara.SyntaxError: line 22: unterminated regular expression
Traceback (most recent call last):
File "\\vboxsvr\workspace\Loki\loki.py", line 1126, in initialize_yara_rules
yara.SyntaxError: line 22: unterminated regular expression
Neo23x0 commented
I cannot reproduce the error with the current version and the current rule set.
Neo23x0 commented
It's also a shit way to report errors not indicating the version number of the software, which OS, the command line, if customer rules are used etc.