Rekall segfaults in newer distros

[Thomas Spuhler]

since some of the developer seem to be back I may want to post this again
When opening a table, Rekall segfaults.
Dist is Mandriva 2007.1. Still worked in 2007.0
I was told in some of the replies it's a Mandriva problem because of using
python 2.5 , but my son just called me an he has the same thin on a Suse
install.

--
Thomas J Spuhler

_______________________________________________
Rekall mailing list
Rekall@...
http://www.mailman.a-i-s.co.uk/cgi-bin/mailman/listinfo/rekall

[Chris Poupart]

Thomas Spuhler wrote:
> since some of the developer seem to be back I may want to post this again
> When opening a table, Rekall segfaults.
> Dist is Mandriva 2007.1. Still worked in 2007.0
> I was told in some of the replies it's a Mandriva problem because of using
> python 2.5 , but my son just called me an he has the same thin on a Suse
> install.
>  
I have a similar problem on Ubuntu Feisty, but only setting up a
database connection (in this case, MySQL).  If I take the .rkl file
already created, then Rekall works well.

-- Chris
_______________________________________________
Rekall mailing list
Rekall@...
http://www.mailman.a-i-s.co.uk/cgi-bin/mailman/listinfo/rekall

[kent-usa-mo]

I too have this problem with SUSE 10.2.

Logs of Rekall build and Crash debug output attached

CrashContext
Rekall245_buildlog_20070703.log

[kent-usa-mo]

Well, it seems that I have a possible "Patch" for the crashing with python 2.5.

I made the following source change in 2.4.5, rebuilt and was able to view tables and forms again (HURRAY!!!)

Change source   script/python/kb_pyscript.cpp , line 1090 from
        PyExc_IOError = 0  ;
to
        /* PyExc_IOError = 0  ; */
and recompile.

Basically this comments out this line of code.


I'm not a coder, but it appears that PyExc_IOError is an object in python 2.5 and setting the extern variable to zero is no longer initializing a variable (as in older python versions), but nullifying an object address.

I have not done very much testing, but is seems to work.  I would appreciate postings if anyone finds any problems this causes.

If I was guessing, I would guess that commenting this line out could cause error handling routines to fail.

It is a patch as we do not know WHY the PyExc_IOError was being set to zero.  It may be that it still needs to be set to something (like creating a new object),  but I'll leave this to one of the real Rekall developers to work out.

[Thomas Spuhler]

On Tuesday 11 September 2007, kent-usa-mo wrote:

> Well, it seems that I have a possible "Patch" for the crashing with python
> 2.5.
>
> I made the following source change in 2.4.5, rebuilt and was able to view
> tables and forms again (HURRAY!!!)
>
> Change source   script/python/kb_pyscript.cpp , line 1090 from
> PyExc_IOError = 0  ;
> to
> /* PyExc_IOError = 0  ; */
> and recompile.
>
> Basically this comments out this line of code.
>
>
> I'm not a coder, but it appears that PyExc_IOError is an object in python
> 2.5 and setting the extern variable to zero is no longer initializing a
> variable (as in older python versions), but nullifying an object address.
>
> I have not done very much testing, but is seems to work.  I would
> appreciate postings if anyone finds any problems this causes.
>
> If I was guessing, I would guess that commenting this line out could cause
> error handling routines to fail.
>
> It is a patch as we do not know WHY the PyExc_IOError was being set to
> zero. It may be that it still needs to be set to something (like creating a
> new object),  but I'll leave this to one of the real Rekall developers to
> work out.

Didn't work here. the rpmbuild gives me this error almost at the end (doesn't
make sense to me). Without this change the build completes.

rekall-2.4.5/script/python/tkc_pyvaluelist.cpp:187: error: ‘struct _frame’ has
no member named ‘f_nlocals’
scons: *** [build/qt3/rekall-2.4.5/script/python/tkc_pyvaluelist.os] Error 1
make: *** [qt3] Error 2
error: Bad exit status from /home/tjs/rpm/tmp/rpm-tmp.76682 (%build)


RPM build errors:
    Bad exit status from /home/tjs/rpm/tmp/rpm-tmp.76682 (%build)


--
Thomas

_______________________________________________
Rekall mailing list
Rekall@...
http://www.mailman.a-i-s.co.uk/cgi-bin/mailman/listinfo/rekall

[Thomas Spuhler]

On Tuesday 11 September 2007, kent-usa-mo wrote:

> Well, it seems that I have a possible "Patch" for the crashing with python
> 2.5.
>
> I made the following source change in 2.4.5, rebuilt and was able to view
> tables and forms again (HURRAY!!!)
>
> Change source   script/python/kb_pyscript.cpp , line 1090 from
> PyExc_IOError = 0  ;
> to
> /* PyExc_IOError = 0  ; */
> and recompile.
>
> Basically this comments out this line of code.
>
>
> I'm not a coder, but it appears that PyExc_IOError is an object in python
> 2.5 and setting the extern variable to zero is no longer initializing a
> variable (as in older python versions), but nullifying an object address.
>
> I have not done very much testing, but is seems to work.  I would
> appreciate postings if anyone finds any problems this causes.
>
> If I was guessing, I would guess that commenting this line out could cause
> error handling routines to fail.
>
> It is a patch as we do not know WHY the PyExc_IOError was being set to
> zero. It may be that it still needs to be set to something (like creating a
> new object),  but I'll leave this to one of the real Rekall developers to
> work out.

Didn't work here. the rpmbuild gives me this error almost at the end (doesn't
make sense to me). Without this change the build completes.

rekall-2.4.5/script/python/tkc_pyvaluelist.cpp:187: error: ‘struct _frame’ has
no member named ‘f_nlocals’
scons: *** [build/qt3/rekall-2.4.5/script/python/tkc_pyvaluelist.os] Error 1
make: *** [qt3] Error 2
error: Bad exit status from /home/tjs/rpm/tmp/rpm-tmp.76682 (%build)


RPM build errors:
    Bad exit status from /home/tjs/rpm/tmp/rpm-tmp.76682 (%build)


--
Thomas

_______________________________________________
Rekall mailing list
Rekall@...
http://www.mailman.a-i-s.co.uk/cgi-bin/mailman/listinfo/rekall

[kent-usa-mo]

Yes, I have seen this error in 2.4.5.  Mike Richardson published a temporary fix for this one in Rekall - General reference posting "Re: gcc compile fails, help needed  - Mike Richardson-2 Feb 22, 2007; 04:39am".  He responded to a post by Andreas Heinz.

I applied this this patch to the 2.4.5 source previously.  Since it was an already published problem/fix I did not mention it -- Sorry.....

Thomas Spuhler wrote:

Didn't work here. the rpmbuild gives me this error almost at the end (doesn't
make sense to me). Without this change the build completes.

rekall-2.4.5/script/python/tkc_pyvaluelist.cpp:187: error: ‘struct _frame’ has
no member named ‘f_nlocals’
scons: *** [build/qt3/rekall-2.4.5/script/python/tkc_pyvaluelist.os] Error 1
make: *** [qt3] Error 2
error: Bad exit status from /home/tjs/rpm/tmp/rpm-tmp.76682 (%build)


RPM build errors:
    Bad exit status from /home/tjs/rpm/tmp/rpm-tmp.76682 (%build)


--
Thomas

_______________________________________________
Rekall mailing list
[e-mail]
http://www.mailman.a-i-s.co.uk/cgi-bin/mailman/listinfo/rekall

[kent-usa-mo]

I have tested out all of my DB's and applications after the change to fix Python 2.5 crashing.  There have been no major issues.  All my forms, reports, tables and database are as they were prior to the upgrade to Python 2.5.  So, it appears that I have a good Rekall 245 running with SUSE 10.2 using Python 2.5, with 2 patches.