Skip to content

yara.py not correctly finding executable on imported projects #7

@tfriesen

Description

@tfriesen

Long story short, I'm following your excellent Youtube series on reversing wannacry, and due to headaches with the ooanalyzer plugin, moved from Windows to Linux, and transferred the project from one to the other in order to preserve my work so far.

However, the following line in yara.py:

currentProgram.getDomainFile().getMetadata()["Executable Location"]

Returns the old location on my C: drive, rather than its current location in my Linux machine. I can workaround this by manually specifying the executable location.

This may be a bug with Ghidra rather than your script.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions