{"componentChunkName":"component---src-templates-post-template-js","path":"/malware-flarevm-loadpmlerror-en","result":{"data":{"markdownRemark":{"id":"d5d1e300-3653-5032-84a9-d25a11f8ba34","html":"
\n

This page has been machine-translated from the original page.

\n
\n

This article explains how to resolve the issue where Noriben fails to function properly in FlareVM 3.1, the malware analysis and forensics distribution I recently set up.

\n

I documented the solution to the problem where PML files are generated in the Noriben folder, but even when running with full privileges, the files cannot be opened and result in an error.

\n

\n \n \n \n \n \n \n \n \n

\n

It seems that when using modules under chocolatey, files created by Procmon become inaccessible, causing errors.

\n

In terms of module usage priority, the current directory has the highest priority, and the following issue mentions resolving it using this method.

\n

Reference: Python “requests” module mussing, ProcMon cannot open pml file for reading and CSV file cannot be created. · Issue #14 · Rurik/Noriben

\n

However, in my environment and according to the following article, Noriben didn’t work properly just by placing the module in the current directory.

\n

Reference: Noribenが「Error creating CSV」で動作しない問題の解決方法 - Qiita

\n

Also, the above article mentions that the issue was resolved by setting default apps for txt/csv/pml, but this method didn’t solve the problem in my environment.

\n

Configuration Details

\n

Downloading Modules and Setting Environment Variables

\n

I placed the Procmon downloaded from Sysinternals Suite - Windows Sysinternals | Microsoft Docs in a subfolder under Desktop and set the system environment variable.

\n

\n \n \n \n \n \n \n \n \n

\n

In this image, the SubTools folder containing Procmon is set one position above C:\\ProgramData\\chocolatey\\bin\\.

\n

Reference: Windows 10でPath環境変数を設定／編集する：Tech TIPS - ＠IT

\n

When changing environment variables from this screen, the change notification is sent via WM_SETTINGCHANGE, so it takes effect immediately and Noriben becomes usable.

\n

If it doesn’t take effect, try restarting the OS.

\n

PATH Search Order

\n

When the system searches for executable modules, it explores PATHs in the following order:

\n
    \n
  1. Current directory
    2. \n
  2. Environment variable PATH
    3. \n
  3. “HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths”
    4. \n
\n

The PATHs set in the environment variable PATH are searched and prioritized from top to bottom.

\n

Additionally, environment variables are divided into system environment variables and user environment variables, with PATHs set in system environment variables taking priority over those in user environment variables.

\n

In this case, it was necessary to define the PATH of the folder containing Procmon in the system environment variables at a position above C:\\ProgramData\\chocolatey\\bin\\.

\n

Summary

\n

Noriben is now working in FlareVM.

","fields":{"slug":"/malware-flarevm-loadpmlerror-en","tagSlugs":["/tag/malware-en/","/tag/flare-vm-en/","/tag/備忘録/","/tag/english/"]},"frontmatter":{"date":"2021-12-03","description":"This article explains how to resolve the issue where Noriben fails to function properly in FlareVM 3.1, the malware analysis and forensics distribution I recently set up.","tags":["Malware (en)","FlareVM (en)","備忘録","English"],"title":"Fixing Noriben's PML File Loading Error and CSV Creation Failure in FlareVM","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/malware-flarevm-loadpmlerror-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}