yara-python installation fatal error about mara_framework HOT 7 CLOSED

Do not install yara-python via pip, you need to use the version of yara on the rednaga repo. Inside the MARA_Framework folder, try and delete the yara-python folder, located inside the tools folder. Then run these commands inside the tools folder:

• git clone https://github.com/rednaga/yara-python
• cd yara-python/
• sudo -H python setup.py install
• sudo -H pip install apkid

from mara_framework.

@xtiankisutsa Thanks for the quick response. When running the "sudo -H python setup.py install" command it exits with the following error:

yara/libyara/modules/hash.c:30:10: fatal error: 'openssl/md5.h' file not found
#include <openssl/md5.h>
^
1 error generated.
error: command 'cc' failed with exit status 1

Here's my output from openssl:

MacBook-Pro:~ roman$ brew install openssl
Updating Homebrew...
Warning: openssl 1.0.2l is already installed
MacBook-Pro:~ roman$ brew unlink openssl && brew link openssl --force
Unlinking /usr/local/Cellar/openssl/1.0.2l... 0 symlinks removed
Warning: Refusing to link: openssl
Linking keg-only openssl means you may end up linking against the insecure,
deprecated system OpenSSL while using the headers from Homebrew's openssl.
Instead, pass the full include/library paths to your compiler e.g.:
-I/usr/local/opt/openssl/include -L/usr/local/opt/openssl/lib

from mara_framework.

This seems like an issue with openssl, please try running

• brew install openssl
  or
• brew install openssl --upgrade

from mara_framework.

@xtiankisutsa openssl is already installed and latest version. I think it's an issue with it refusing to link ? (refer to snippet from above)

MacBook-Pro:~ roman$ brew install openssl --upgrade
Updating Homebrew...
Warning: openssl 1.0.2l is already installed

"Warning: Refusing to link: openssl
Linking keg-only openssl means you may end up linking against the insecure,
deprecated system OpenSSL while using the headers from Homebrew's openssl.
Instead, pass the full include/library paths to your compiler e.g.:
-I/usr/local/opt/openssl/include -L/usr/local/opt/openssl/lib"

from mara_framework.

I recommend opening an issue on the APKiD repo here. They are definitely in a much better position to assist.

from mara_framework.

The only viable solution for this I've been able to find is you could disable the module which requires crypto. I believe it is the hash module. So skimming the setup.py you likely could change:

  if building_for_windows:
    module.define_macros.append(('HASH_MODULE', '1'))
    module.libraries.append('libeay%s' % bits)
  elif (has_function('MD5_Init', libraries=['crypto']) and
      has_function('SHA256_Init', libraries=['crypto'])):
    module.define_macros.append(('HASH_MODULE', '1'))
    module.libraries.append('crypto')
  else:
    exclusions.append('yara/libyara/modules/hash.c')

to

  exclusions.append('yara/libyara/modules/hash.c')

from mara_framework.

This issue is not present on the APKiD v1.2.1 which is the latest version at this point in time.

from mara_framework.