installation problem about pharos HOT 18 CLOSED

Can you include more of the error? Specifically, what command failed inside the build.bash script that caused the process to fail?

Building the docker image requires a fair amount of memory and disk space, and it can fail if you don't have enough. You can try this branch which should help if either of those is the problem.

from pharos.

I think my previous problem is due to the lack of memory, I tried to follow the installation file step by step today and I finished the installation of dependencies.
But at last when I use command
"$ cd pharos
$ mkdir build
$ cd build
$ cmake ..
$ make -j4" to install, another error occurred.

(Thanks for your advice, and the installation of ROSE is really ...... )

from pharos.

It looks like it can't find ROSE. Does /usr/local/bin/rose-config exist?

from pharos.

Yes it is. I chmod 777 of the it, and it didn't work.
It has anything to do with the cmake version? My is about 3.9

from pharos.

What does /usr/local/bin/rose-config -V output?

from pharos.

It sounds like a problem with ROSE, not cmake.

from pharos.

If you've built and installed ROSE using cmake, there are known problems with the ROSE cmake configuration that will prevent Pharos from building. The failure to install rose-config is but one of these problems, and we're working with the ROSE developers to correct the issues. In the mean time, it's important to ensure that you've built ROSE with automake. Hopefully this helps resolve your issue.

from pharos.

It looks like a ROSE problem,

The librose.so* do exits, but the error still occurred.

from pharos.

I have finished the installation just now by creating a new virtual machine. I gave the VM 12G memory and it takes about 4 hours to install, these time I didn't meet error. I guess that it at least need 10G memory to accomplish the installation if you want to success at the first time .Thank god and all of you :-)
There is another issue is when I use ooanalyzer by docker to analysis an file , I meet a XSB error :

it looks like a path during installation.

By the way, is it normal Unable to start Prolog session? ?_?

from pharos.

I will see if I can reproduce, but does the referenced file exist, and is it readable by you?

from pharos.

I don't see this behavior. This is using our Docker file? Did you modify anything? What command line are you running?

from pharos.

It is not normal to fail when starting the Prolog session. I've encountered the xsb_configuration.P error on several occasions, but do not understand the cause. It's something in the XSB installation procedure. My experience has been that touching the missing file is often sufficient to work around the problem.

from pharos.

Thanks, I'll ask you later if I meet other question. :-)

from pharos.

I don't see this behavior. This is using our Docker file? Did you modify anything? What command line are you running?

Hi, I have the same error when I run callanalyzer --analyze-type --allow-64bit fp-5, how can I solve the problem? The /root is empty on my container. When I run callanalyzer --show-symbolic on my efl executable, it shows complete, but where can I see the analysis result? I didn't see any new output file.

from pharos.

The --analyze-type option uses Prolog, which explains why if you did not have a working Prolog installation you would get that error.

I think the problem is that we are removing the original build directories in /root to save space for the Docker container. I believe that is removing files that XSB Prolog needs. I am investigating more.

from pharos.

The --analyze-type option uses Prolog, which explains why if you did not have a working Prolog installation you would get that error.

I think the problem is that we are removing the original build directories in /root to save space for the Docker container. I believe that is removing files that XSB Prolog needs. I am investigating more.

Thank you for the response and taking your time for my issue! I want to confirm with you that, does pharos also works for linux binary? As I found tests in the repository are all windows executable, I run callanalyzer --show-symbolic over ELF binaries, it shows nothing, but gives all the function calls (and parameters) when I run it on windows executable which I grab from tests.
I'm not quite understand how callanalyzer gets all the function calls (along with its parameters) from binary (so far as I understand, the binary is for windows executable?), I didn't find any main function call among those output though.

from pharos.

The Pharos framework has primarily been tested and developed to analyze Windows binaries. The underlying ROSE framework supports ELF executables, and much of that capability has carried forward automatically into Pharos. Importantly for type analysis and the CallAnalyzer tool, the API database is not populated with the parameter types of Linux API calls, which will reduce the effectiveness of the tool. Conceptually it should not be too difficult to extend the API database to include some Linux APIs, but there are also some deficiencies in the Pharos framework related to ELF import handling. In summary, you are correct in noting that CallAnalyzer does not currently operate on ELF executables as well as on Windows executables. If you're interested in investigating further, look at apidb.cpp, and the SQLite database in share/apidb for the answers to some your questions about external API type detection.

from pharos.

The Pharos framework has primarily been tested and developed to analyze Windows binaries. The underlying ROSE framework supports ELF executables, and much of that capability has carried forward automatically into Pharos. Importantly for type analysis and the CallAnalyzer tool, the API database is not populated with the parameter types of Linux API calls, which will reduce the effectiveness of the tool. Conceptually it should not be too difficult to extend the API database to include some Linux APIs, but there are also some deficiencies in the Pharos framework related to ELF import handling. In summary, you are correct in noting that CallAnalyzer does not currently operate on ELF executables as well as on Windows executables. If you're interested in investigating further, look at apidb.cpp, and the SQLite database in share/apidb for the answers to some your questions about external API type detection.

I see, thank you for the response! I will look into it.

from pharos.