Could not import module Yara

Question

I am currently attempting to run Volatility3, but I have encountered an error which is caused by yara failing on import.

The main issue is I am unable to import yara even on CMD by typing python then import yara, doing so would get an error like this:

FileNotFoundError: Could not find module 'C:Program FilesWindowsAppsPythonSoftwareFoundation.Python.3.9_3.9.3312.0_x64__qbz5n2kfra8p0DLLslibyara.dll' (or one of its dependencies). Try using the full path with constructor syntax.

Full Error

Failed to import 'C:Program FilesWindowsAppsPythonSoftwareFoundation.Python.3.9_3.9.3312.0_x64__qbz5n2kfra8p0DLLslibyara.dll'
PATH = (***other programs within the path such as git***);C:Program FilesWindowsAppsPythonSoftwareFoundation.Python.3.9_3.9.3312.0_x64__qbz5n2kfra8p0DLLs
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "C:UsersUserAppDataLocalPackagesPythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0LocalCachelocal-packagesPython39site-packagesyara__init__.py", line 7, in <module>
    from yara.rules import compile
  File "C:UsersUserAppDataLocalPackagesPythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0LocalCachelocal-packagesPython39site-packagesyararules.py", line 17, in <module>
    from yara.libyara_wrapper import *
  File "C:UsersUserAppDataLocalPackagesPythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0LocalCachelocal-packagesPython39site-packagesyaralibyara_wrapper.py", line 315, in <module>
    libyaradll = cdll.LoadLibrary(library)
  File "C:Program FilesWindowsAppsPythonSoftwareFoundation.Python.3.9_3.9.3312.0_x64__qbz5n2kfra8p0libctypes__init__.py", line 452, in LoadLibrary
    return self._dlltype(name)
  File "C:Program FilesWindowsAppsPythonSoftwareFoundation.Python.3.9_3.9.3312.0_x64__qbz5n2kfra8p0libctypes__init__.py", line 374, in __init__
    self._handle = _dlopen(self._name, mode)
FileNotFoundError: Could not find module 'C:Program FilesWindowsAppsPythonSoftwareFoundation.Python.3.9_3.9.3312.0_x64__qbz5n2kfra8p0DLLslibyara.dll' (or one of its dependencies). Try using the full path with constructor syntax.

These are some of the stuff I’ve attempted

Installing yara source from Github and and running setup.py without any errors
Uninstalled and reinstalled via pip
Run requirement.txt, it says I’ve fulfilled the requirements

Some other notes:

My OS is Win11
My python version is 3.9.12

Based on the error I received, I believe the libyara library is missing, I’ve tried looking up on many other solutions online but no luck on fixing this issue. Any help provided on this matter will be greatly appreciated.

Asked By: Remicaster

||

Source

Answer 1

pip uninstall yara

pip install yara-python

Answered By: CKCat

Answer 2

While this is not the best solution, my solution of this issue is to not use Windows for Volatility3.

If you are on a windows machine, just use a VM and plug any Linux distro into it and it will work instantly (at that time I was using Kali). This more or less resolved the issue I was facing and got what I wanted from memory forensic on Volatility3.

Edit:
This seems like a specific issue to python3 if installed via Microsoft Store, I tried reinstalling Python3 with stuff like Scoop.sh and I have fixed the issue.

Answered By: Remicaster

Could not import module Yara

Question:

Answers: