OSError: /usr/lib/libyara.so: cannot open shared object file: No such file or directory

Question

I have some issue trying to run Volatility 3 Framework.

git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3/
python3 vol.py ../ramdumps/1289.raw windows.pslist.PsList

I got this error traceback:

Volatility 3 Framework 2.0.0
Failed to import '/usr/lib/libyara.so'
PATH = /home/user/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/usr/local/go/bin:/home/user/go/bin;/usr/lib
Traceback (most recent call last):
  File "vol.py", line 10, in <module>
    volatility3.cli.main()
  File "/home/user/Documents/volatility3/volatility3/cli/__init__.py", line 625, in main
    CommandLine().run()
  File "/home/user/Documents/volatility3/volatility3/cli/__init__.py", line 229, in run
    True)  # Will not log as console's default level is WARNING
  File "/home/user/Documents/volatility3/volatility3/framework/__init__.py", line 127, in import_files
    ignore_errors)
  File "/home/user/Documents/volatility3/volatility3/framework/__init__.py", line 152, in import_file
    importlib.import_module(module)
  File "/usr/lib/python3.6/importlib/__init__.py", line 126, in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
  File "<frozen importlib._bootstrap>", line 994, in _gcd_import
  File "<frozen importlib._bootstrap>", line 971, in _find_and_load
  File "<frozen importlib._bootstrap>", line 955, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 665, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 678, in exec_module
  File "<frozen importlib._bootstrap>", line 219, in _call_with_frames_removed
  File "/home/user/Documents/volatility3/volatility3/framework/plugins/yarascan.py", line 17, in <module>
    import yara
  File "/home/user/.local/lib/python3.6/site-packages/yara/__init__.py", line 7, in <module>
    from yara.rules import compile
  File "/home/user/.local/lib/python3.6/site-packages/yara/rules.py", line 17, in <module>
    from yara.libyara_wrapper import *
  File "/home/user/.local/lib/python3.6/site-packages/yara/libyara_wrapper.py", line 315, in <module>
    libyaradll = cdll.LoadLibrary(library)
  File "/usr/lib/python3.6/ctypes/__init__.py", line 426, in LoadLibrary
    return self._dlltype(name)
  File "/usr/lib/python3.6/ctypes/__init__.py", line 348, in __init__
    self._handle = _dlopen(self._name, mode)
OSError: /usr/lib/libyara.so: cannot open shared object file: No such file or directory

Someone already had the same error a few years ago but none of the answers worked for me.

I'm using python 3.6.9 and Xubuntu 18.04.6

Answer 1

You have to uninstall yara with pip. Only tara-python must be installed.

Answer 2

Did you install the requirements with pip3 install -r requirements.txt ?