Re: Unable to open database with Runtime.

On Friday 24 Sep 2004 16:56, Benjamin Long wrote:
> On Friday 24 September 2004 12:44 pm, Mike Richardson wrote:
> > On Friday 24 Sep 2004 15:48, Benjamin Long wrote:
> > > Greetings!
> > >
> > >  I've just started using rekall, It's a great app! Thanks to all who
> > > work on it.
> > >
> > >  I've created a small database using the mysql backend. Everything
> > > works fine when I use the main rekall app, but when I try to open it
> > > with the runtime I get the following error:
> > >
> > > Argument missing: Invalid macro 'OpenForm' ignored,
> > >
> > > After telling me it cant open the database, rekallrt closes.
> > > I'm running version 2.2.1 on Debian Sarge, compiled from source.
> > > Any help would be greatly appreciated!
> >
> > Sounds like the macro support is missing from the RT build. Two
> > possibilities:
> >
> > * Is there a library file (wherever they go on Sarge) named like
> > libkbasert_plugin_extra.so installed. If not then the entire macro
> > support has not been included in the runtime
> >
> > * There is a file in libs/extra called extra.mac. At a guess, this might
> > not be installed. It would need to be in
> > $PREFIX/usr/shares/apps/rekallrt/dict (where $PREFIX is /usr or /opt/kde
> > ow whatever).
> >
> > I'd guess the former rather than the latter ....
> >
> > SInce the full version works, you should be able to find
> > libkbase_plugin_extra.so (the full version of the library containing the
> > macro support) and  $PREFIX/usr/shares/apps/rekall/dict/extra.mac
>
> I think I have both these conditions covered:
>
> # dpkg -S libkbasert_plugin_extra.so extra.mac
> rekall: /usr/lib/libkbasert_plugin_extra.so
> rekall: /usr/share/apps/rekall/dict/extra.mac
>
> /usr/share/apps/rekallrt is a soft link to /usr/share/apps/rekall
>
> However, looking at that library made me think. I
> moveed /usr/lib/libkbasert_plugin_extra.so
> to /usr/lib/libkbasert_plugin_extra.so.old, then
> copied /usr/lib/libkbase_plugin_extra.so into it's place. After doing this,
> rekallrt worked.
>
> Heres what the files look like with ls:
> # ls -lh /usr/lib/libkbasert_plugin_extra.so*
> -rwxr-xr-x  1 root root 46k Sep 24 11:48
> /usr/lib/libkbasert_plugin_extra.so -rwxr-xr-x  1 root root  8.8k Sep 24
> 09:41 /usr/lib/libkbasert_plugin_extra.so.old
>
> Is libkbasert_plugin_extra.so really only 8.8k? Did I have some kind of
> compile error maybe?

That does sound rather small:) I'd expect it to be almost the same size as the 
non-run-time (full) version since there is little if anything in there that 
is non-run-time specific.

>
> Benjamin Long
> _______________________________________________
> Rekall mailing list
> Rekall-TvUNdCdnGOiN0BpGcQGnph2eb7JE58TQ@xxxxxxxxxxxxxxxx
> http://www.mailman.a-i-s.co.uk/cgi-bin/mailman/listinfo/rekall

-- 
Regards
Mike

http://www.rekallrevealed.org
*THE* GPL/Open Source database front end for Linux and Windows.