Error: TypeError: can't multiply sequence by non-int of type 'float'

[dbosanzio]

Hi, thanks for your tool.
Your work is much appreciated
I'm trying to start it but I get the following error:
C:\Python34>python.exe c:\Noriben-master\Noriben.py
--===[ Noriben v1.6.2 ]===--
Traceback (most recent call last):
File "c:\Noriben-master\Noriben.py", line 1202, in
main()
File "c:\Noriben-master\Noriben.py", line 997, in main
print(header2 % (' ' * (padding / 2), ' ' * (padding / 2)))
TypeError: can't multiply sequence by non-int of type 'float'

C:\Python34>

I test on windows 7 64 bit with Python 3.4.3 (64 bit version) and Python 3.2.5.1 32 bit version, getting the same error.
May you help me to fix this error?

Thanks a lot.

[Rurik]

I apologize for this. I added a slight aesthetic modification that caused
that issue. I'm not sure exactly why it error'd, and will look into that,
but I have added error handling to prevent it from crashing.

Please try the new version that I just committed and see if it works.

On Tue, Apr 28, 2015 at 7:29 AM, dbosanzio notifications@github.com wrote:

Hi, thanks for your tool.
Your work is much appreciated
I'm trying to start it but I get the following error:
C:\Python34>python.exe c:\Noriben-master\Noriben.py
--===[ Noriben v1.6.2 ]===--
Traceback (most recent call last):
File "c:\Noriben-master\Noriben.py", line 1202, in
main()
File "c:\Noriben-master\Noriben.py", line 997, in main
print(header2 % (' ' * (padding / 2), ' ' * (padding / 2)))
TypeError: can't multiply sequence by non-int of type 'float'

C:\Python34>

I test on windows 7 64 bit with Python 3.4.3 (64 bit version) and Python
3.2.5.1 32 bit version, getting the same error.
May you help me to fix this error?

Thanks a lot.

—
Reply to this email directly or view it on GitHub
#5.

[dbosanzio]

Thanks.

Now I get the following error:
C:\Python34>python.exe c:\Noriben-master\Noriben.py
File "c:\Noriben-master\Noriben.py", line 1000
print '--==[ Noriben v%s ]==--' % VERSION
^
SyntaxError: Missing parentheses in call to 'print'

Thanks for your help.

[Rurik]

I'm very sorry. I made a quick fix but didn't actually test it. I've
resolved that error. The new one fixes that mistake.

On Tue, Apr 28, 2015 at 9:01 AM, dbosanzio notifications@github.com wrote:

Thanks.

Now I get the following error:
C:\Python34>python.exe c:\Noriben-master\Noriben.py
File "c:\Noriben-master\Noriben.py", line 1000
print '--==[ Noriben v%s ]==--' % VERSION
^
SyntaxError: Missing parentheses in call to 'print'

Thanks for your help.

—
Reply to this email directly or view it on GitHub
#5 (comment).

[dbosanzio]

Thanks.
Now I get the following error:
C:\Python34>python.exe c:\Noriben-master\Noriben.py
--===[ Noriben v1.6.2 ]===--
--==[ Noriben v1.6.2 ]==--
[!] Filter file ProcmonConfiguration.PMC not found. Continuing without filters.
[!] Unable to find Procmon (procmon.exe) in path.

I copied the procmon.exe in the Noriben-master folder where ther's the Noriben.py:

C:\Python34>python.exe c:\Noriben-master\Noriben.py
--===[ Noriben v1.6.2 ]===--
--==[ Noriben v1.6.2 ]==--
[!] Filter file ProcmonConfiguration.PMC not found. Continuing without filters.
[!] Unable to find Procmon (procmon.exe) in path.

C:\Python34>cd c:\Noriben-master

c:\Noriben-master>dir

Directory di c:\Noriben-master

Directory di c:\Noriben-master

29/04/2015 10:29

.
29/04/2015 10:29 ..
29/04/2015 10:29 51.337 Noriben.py
31/03/2015 19:20 2.044.552 Procmon.exe
29/04/2015 10:29 6.470 ProcmonConfiguration.pmc
29/04/2015 10:29 9.297 README.md
29/04/2015 10:29 Sample
29/04/2015 10:36 64 virustotal.api

[Rurik]

This is due to how Noriben checks for procmon.exe.

It will first check to see if procmon is in the current working directory,
then check each directory in the system PATH. In your case, you're running
Noriben from the C:\Python34 directory, so it's expecting Procmon to be
there.

I have not yet added the ability for the program to resolve its called
directory and look for files there, but it is in my TODO list.

For now I'd recommend either adding the executable to a folder in your path
or running Python from the Noriben folder:

C:\Noriben-master> C:\Python34\Python.exe Noriben.py

On Wed, Apr 29, 2015 at 1:37 AM, dbosanzio notifications@github.com wrote:

Thanks.
Now I get the following error:
C:\Python34>python.exe c:\Noriben-master\Noriben.py
--===[ Noriben v1.6.2 ]===--
--==[ Noriben v1.6.2 ]==--
[!] Filter file ProcmonConfiguration.PMC not found. Continuing without
filters.
[!] Unable to find Procmon (procmon.exe) in path.

I copied the procmon.exe in the Noriben-master folder where ther's the
Noriben.py:

C:\Python34>python.exe c:\Noriben-master\Noriben.py
--===[ Noriben v1.6.2 ]===--
--==[ Noriben v1.6.2 ]==--
[!] Filter file ProcmonConfiguration.PMC not found. Continuing without
filters.
[!] Unable to find Procmon (procmon.exe) in path.

C:\Python34>cd c:\Noriben-master

c:\Noriben-master>dir

Directory di c:\Noriben-master

Directory di c:\Noriben-master

29/04/2015 10:29
.
29/04/2015 10:29 ..
29/04/2015 10:29 51.337 Noriben.py
31/03/2015 19:20 2.044.552 Procmon.exe
29/04/2015 10:29 6.470 ProcmonConfiguration.pmc
29/04/2015 10:29 9.297 README.md
29/04/2015 10:29 Sample
29/04/2015 10:36 64 virustotal.api

—
Reply to this email directly or view it on GitHub
#5 (comment).

[dbosanzio]

Thanks. Now it works.
There is just still a problem .
It is not displayed the network traffic data
despite having surfed with firefox (for example)

Network Traffic:

Unique Hosts:

ERRORS DETECTED
The following items could not be parsed correctly:
"13:18:57,8034577","firefox.exe","3288","RegSetValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings","SUCCESS","Type: REG_BINARY, Length: 1.336, Data: 46 00 00 00 D5 01 00 00 09 00 00 00 00 00 00 00","4324"

[Rurik]

This will be slightly difficult to troubleshoot. Ultimately, Procmon is not
collecting the data for some reason. The way to verify this is to
grep/search the original Noriben CSV file for "TCP Send" or "TCP Receive".
These are the key words that Noriben picks up on to collect network
indicators.

If there are no entries with those then likely Procmon is just not
collecting it. The quickest way to check this is to run Noriben and then
click on the minimized Procmon window in the task bar. Towards the upper
right will be five icons that indicate each category of logging. Ensure
that the third one is select (stacked computer icon) to enable network
monitoring. You can then run your applications (Firefox) and close Noriben
as normal.

If that resolves it, you should be good. That setting should remain set in
the registry and work in the future. However, if Procmon is still not
creating TCP Send or TCP Receive events, there's little I can do.

On Wed, Apr 29, 2015 at 5:03 AM, dbosanzio notifications@github.com wrote:

Thanks. Now it works.
There is just still a problem .
It is not displayed the network traffic data
despite having surfed with firefox (for example)
Network Traffic: Unique Hosts:

ERRORS DETECTED
The following items could not be parsed correctly:
"13:18:57,8034577","firefox.exe","3288","RegSetValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Connections\SavedLegacySettings","SUCCESS","Type: REG_BINARY,
Length: 1.336, Data: 46 00 00 00 D5 01 00 00 09 00 00 00 00 00 00 00","4324"

—
Reply to this email directly or view it on GitHub
#5 (comment).

[dbosanzio]

Thanks for your help.
I resetted the filter of procmon than I checked that selecting only the network icon there was traffic displayed. After that I enabled all monitoring icons an than save and overwrite the procmon config file "ProcmonConfiguration.pmc". Now all work good and the netwrok traffic is displayed.

Best regard. This case is close for me.
Thanks a lot.

PS: it may be useful, I made Noriben portable using Python Portable:

1)Download Python Portable from http://portablepython.com/wiki/PortablePython3.2.5.1/

2. Download Python module setuptools "https://pypi.python.org/packages/source/s/setuptools/setuptools-15.2.zip" an copied and extracted in "C:\Portable Python 3.2.5.1\setuptools-15.2"

3)I installed setuptool with the following command:
"c:\Portable Python 3.2.5.1\App\python.exe" "c:\Portable Python 3.2.5.1\setuptools-15.2\setup.py" install

4)I installed pip with the following command:
"c:\Portable Python 3.2.5.1\App\Scripts\easy_install.exe" pip

5)I Installed the requests module with the following command:
"c:\Portable Python 3.2.5.1\App\Scripts\pip.exe" install requests

6. I copied the folder Noriben-master in "C:\Portable Python 3.2.5.1"

7)I started the Noriben sandbox with the following command:

C:\Portable Python 3.2.5.1\Noriben-master>"c:\Portable Python 3.2.5.1\App\python.exe" Noriben.py
--===[ Noriben v1.6.2 ]===--
--==[ Noriben v1.6.2 ]==--
[] Using filter file: ProcmonConfiguration.PMC
[+] Features: (Debug: False YARA: False VirusTotal: True)
[] Using procmon EXE: procmon.exe
[] Procmon session saved to: Noriben_30_Apr_15__09_25_14_833000.pml
[] Launching Procmon ...
[] Procmon is running. Run your executable now.
[] When runtime is complete, press CTRL+C to stop logging.

[Rurik]

Glad to hear it's working, thank you for bringing the issues to my attention (and I'll fix that double version header that I see). And awesome about the portable solution. I'm going to use that to share with others!