distorm3 v3.5.0 breaks volatility

[nganhkhoa]

Volatility Foundation Volatility Framework 2.6.1
*** Failed to import volatility.plugins.linux.malfind (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.malware.timers (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.overlays.windows.win8 (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.linux.process_stack (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.drivermodule (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.linux.check_inline_kernel (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.overlays.mac.mac (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.linux.check_syscall (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.overlays.windows.win8_kdbg (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.timeliner (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.malware.apihooks (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.multiscan (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.volshell (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.linux.linux_volshell (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.dumpcerts (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.linux.netscan (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.mac.mac_volshell (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.tcaudit (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.malware.devicetree (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.overlays.windows.win10 (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.malware.threads (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.mac.apihooks_kernel (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.malware.idt (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.linux.linux_truecrypt (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.mbrparser (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.mac.check_syscall_shadow (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.linux.linux_yarascan (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.malware.malfind (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.ssdt (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.mac.apihooks (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.overlays.linux.linux (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.malware.impscan (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.mac.malfind (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.malware.callbacks (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)
*** Failed to import volatility.plugins.mac.mac_yarascan (OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi)

Solution: Use distorm v3.4.4

pip uninstall distorm3
pip install distorm3==3.4.4

[kathrynmcbain]

Spent hours stuck with this - thanks for the solution!

[atcuno]

Thanks for this report. I am pretty certain this is an issue with distorm3 itself and not Volatility. I did pip install distorm3 and got 3.5, and then in just the regular Python interperter produced the following:

# python
Python 2.7.17 (default, Jul 20 2020, 15:37:01) 
[GCC 7.5.0] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import distorm3
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python2.7/dist-packages/distorm3/__init__.py", line 56, in <module>
    _distorm = _load_distorm()
  File "/usr/local/lib/python2.7/dist-packages/distorm3/__init__.py", line 53, in _load_distorm
    return cdll.LoadLibrary(_distorm_file)
  File "/usr/lib/python2.7/ctypes/__init__.py", line 444, in LoadLibrary
    return self._dlltype(name)
  File "/usr/lib/python2.7/ctypes/__init__.py", line 366, in __init__
    self._handle = _dlopen(self._name, mode)
OSError: /usr/local/lib/python2.7/dist-packages/_distorm3.so: undefined symbol: operands_set_tsi

[gdabah]

@nganhkhoa Can you please check latest version 3.5.1 and let me know if it works or not?