Getting error message "Use of uninitialized value $list in pattern match (m//) at PERL2EXE_STORAGE" when using several RR 4.0 plugins that use the module "utf8_heavy.pl"

[CmdrBurrito]

Hello, FYI, I'm getting the following error message whenever I run any RegRipper 4.0 plugin which calls the associated Perl module:

Use of uninitialized value $list in pattern match (m//) at PERL2EXE_STORAGE/utf8_heavy.pl line 399.

Is this due to an error in the Perl module, a problem with the registry data that I'm feeding the RR 4.0 plugins that use the module, a bug in the either the Perl module or RR 4.0 plugins that might need to be fixed, not a bug at all, or something else? Many thanks!

Here are some example runs using the plugin named "fileless.pl":

---

C:\keydet89\RegRipper4.0>rip.exe -r D:\Artifacts\RegFiles\SECURITY -p fileless
Launching fileless v.20200911
fileless v.20200911
(All) Scans a hive file looking for fileless malware entries
MITRE: T1059.001 (persistence)

Use of uninitialized value $list in pattern match (m//) at PERL2EXE_STORAGE/utf8_heavy.pl line 399.

---

C:\keydet89\RegRipper4.0>rip.exe -r D:\Artifacts\RegFiles\SYSTEM -p fileless
Launching fileless v.20200911
fileless v.20200911
(All) Scans a hive file looking for fileless malware entries
MITRE: T1059.001 (persistence)

Use of uninitialized value $list in pattern match (m//) at PERL2EXE_STORAGE/utf8_heavy.pl line 399.

---

C:\keydet89\RegRipper4.0>rip.exe -r D:\Artifacts\RegFiles\SAM -p fileless
Launching fileless v.20200911
fileless v.20200911
(All) Scans a hive file looking for fileless malware entries
MITRE: T1059.001 (persistence)

Use of uninitialized value $list in pattern match (m//) at PERL2EXE_STORAGE/utf8_heavy.pl line 399.

---

However, please note that this same error message pops up when using other plugins that also end up using this same module. This isn't a big issue, it's just merely an annoyance, so this is a low priority for any potential fix. Regards! Thanks for building such an awesome tool!

[keydet89]

I'm not seeing that on any of my test files, and I don't have access to the files you're using. Sorry.

[keydet89]

Also, from what you sent, I'm not seeing that this is preventing the plugin from running, nor does it seem to be producing spurious outputs.

[CmdrBurrito]

In that case, it sounds like the issue is indeed with the registry hives that I'm feeding to the RegRipper plugins, rather than with the RR plugins themselves or the Perl module that they all are using. Also, like you said, this warning message doesn't appear to be preventing the associated plugins from running. As such, since you aren't getting the same results when using any of your test files, I can only conclude that the problem is likely with my specific registry hives. Therefore I'll just live with the error messages that are showing up in the logs. Regards!

[keydet89]

I don't know that that's the case...I haven't seen the hives. It could be an issue with the plugins or something they call.

So let me ask you this...why are you running that plugin? Why not simply move it to another folder, or rename it to fileless.p_?

It's not so much about the messages you're receiving, but rather asking, why are you running that plugin?

[CmdrBurrito]

My apologies, I was just using the "fileless.pl" plugin as an example. FYI, I'm also seeing this warning pop up when running the current "shares.pl" plugin, as well as the deprecated plugins "mspaper.pl", "internet_settings_cu.pl", and "internet_explorer_cu.pl". If it would be helpful, I could post some of the example output that get when running those plugins.

[keydet89]

I think I've seen the example output.

I'll take a look on my end, but like I've said before, I don't have access to the data that you're using.

[CmdrBurrito]

Understood. Many thanks!

BTW, below is a summary of the errors and warnings I've been receiving when executing various current
and deprecated RegRipper plugins, using the RegRipper 4.0 Windows executable ("rip.exe"), against my
various Registry Hives:

Current Plugin Warning Messages

1. fileless.pl - v.20200911
   Use of uninitialized value $list in pattern match (m//) at PERL2EXE_STORAGE/utf8_heavy.pl line 399.

2. shares.pl - v.20201005
   Use of uninitialized value $list in pattern match (m//) at PERL2EXE_STORAGE/utf8_heavy.pl line 399.

Deprecated Plugin Warning Messages

1. mspaper.pl - v.20080324
   Use of uninitialized value $list in pattern match (m//) at PERL2EXE_STORAGE/utf8_heavy.pl line 399.

2. internet_settings_cu.pl - v.20120528
   Use of uninitialized value $list in pattern match (m//) at PERL2EXE_STORAGE/utf8_heavy.pl line 399.

3. internet_explorer_cu.pl - v.20120528
   Use of uninitialized value $list in pattern match (m//) at PERL2EXE_STORAGE/utf8_heavy.pl line 399.

Deprecated Plugin Error Messages

1. eventlogs.pl - v.20081219
   Error in C:\keydet89\RegRipper\plugins\eventlogs.pl: Can't call method "get_data" on an undefined value at C:\keydet89\RegRipper\plugins\eventlogs.pl line 60.

2. ie_zones.pl - v.20140611
   Error in C:\keydet89\RegRipper\plugins\ie_zones.pl: Can't call method "get_list_of_subkeys" on an undefined value at C:\keydet89\RegRipper\plugins\ie_zones.pl line 83.

3. drivers32.pl - v.20200525
   Error in C:\keydet89\RegRipper\plugins\drivers32.pl: Undefined subroutine &main::getDateFromEpoch called at C:\keydet89\RegRipper\plugins\drivers32.pl line 59.

4. svc.pl - v.20200525
   Error in C:\keydet89\RegRipper\plugins\svc.pl: Undefined subroutine &main::getDateFromEpoch called at C:\keydet89\RegRipper\plugins\svc.pl line 161.

5. svcdll.pl - v.20200525
   Error in C:\keydet89\RegRipper\plugins\svcdll.pl: Undefined subroutine &main::getDateFromEpoch called at C:\keydet89\RegRipper\plugins\svcdll.pl line 95.

6. outlook_homepage.pl - v.20201002
   Error in C:\keydet89\RegRipper\plugins\outlook_homepage.pl: Undefined subroutine &main::getDateFromEpoch called at C:\keydet89\RegRipper\plugins\outlook_homepage.pl line 118.

I can post full examples showing the actual output of each plugin run attempt if that would be
helpful.

However, I obviously cannot expect that any action would (or even should), be taken to resolve
any of the warnings or error messages noted above, which are returned by any of the
"deprecated" plugins. Regards!