LibICU not being detected on Debian GNU/Linux 12 (bookworm)

[froglegseternal]

I ran into the following error when just trying to run the help flag with bruteshark:

(john) (base) froglegs@Debian:~/Documents/rootme/challs$ ./BruteSharkCli --help
Process terminated. Couldn't find a valid ICU package installed on the system. Set the configuration flag System.Globalization.Invariant to true if you want to run with no globalization support.
   at System.Environment.FailFast(System.String)
   at System.Globalization.GlobalizationMode.GetGlobalizationInvariantMode()
   at System.Globalization.GlobalizationMode..cctor()
   at System.Globalization.CultureData.CreateCultureWithInvariantData()
   at System.Globalization.CultureData.get_Invariant()
   at System.Globalization.CultureInfo..cctor()
   at System.Globalization.CultureInfo.get_CurrentCulture()
   at System.Text.RegularExpressions.Regex..ctor(System.String, System.Text.RegularExpressions.RegexOptions, System.TimeSpan, Boolean)
   at System.Text.RegularExpressions.Regex..ctor(System.String)
   at PcapAnalyzer.FtpPasswordParser..ctor()
   at System.RuntimeTypeHandle.CreateInstance(System.RuntimeType, Boolean, Boolean, Boolean ByRef, System.RuntimeMethodHandleInternal ByRef, Boolean ByRef)
   at System.RuntimeType.CreateInstanceDefaultCtorSlow(Boolean, Boolean, Boolean)
   at System.RuntimeType.CreateInstanceDefaultCtor(Boolean, Boolean, Boolean, Boolean)
   at System.Activator.CreateInstance(System.Type, Boolean, Boolean)
   at System.Activator.CreateInstance(System.Type)
   at PcapAnalyzer.PasswordsModule+c.<_initilyzepasswordparserslist>b__10_2(System.Type)
   at System.Linq.Enumerable+WhereSelectEnumerableIterator`2[[System.__Canon, System.Private.CoreLib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e],[System.__Canon, System.Private.CoreLib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].ToList()
   at System.Linq.Enumerable.ToList[[System.__Canon, System.Private.CoreLib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](System.Collections.Generic.IEnumerable`1)
   at PcapAnalyzer.PasswordsModule._initilyzePasswordParsersList()
   at PcapAnalyzer.PasswordsModule..ctor()
   at System.RuntimeTypeHandle.CreateInstance(System.RuntimeType, Boolean, Boolean, Boolean ByRef, System.RuntimeMethodHandleInternal ByRef, Boolean ByRef)
   at System.RuntimeType.CreateInstanceDefaultCtorSlow(Boolean, Boolean, Boolean)
   at System.RuntimeType.CreateInstanceDefaultCtor(Boolean, Boolean, Boolean, Boolean)
   at System.Activator.CreateInstance(System.Type, Boolean, Boolean)
   at System.Activator.CreateInstance(System.Type)
   at PcapAnalyzer.Analyzer+c.b__17_2(System.Type)
   at System.Linq.Enumerable+WhereSelectEnumerableIterator`2[[System.__Canon, System.Private.CoreLib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e],[System.__Canon, System.Private.CoreLib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].ToList()
   at System.Linq.Enumerable.ToList[[System.__Canon, System.Private.CoreLib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](System.Collections.Generic.IEnumerable`1)
   at PcapAnalyzer.Analyzer.InitilyzeModulesList()
   at PcapAnalyzer.Analyzer..ctor()
   at BruteSharkCli.BruteSharkCli..ctor(System.String[])
   at BruteSharkCli.Program.Main(System.String[])
Aborted

This might be something upstream, but I have multiple libicu packages installed - both libicu72 and libicu-dev. Would love to be able to provide more information, but I'm not too familiar with C# and wouldn't even know where to begin trying to debug this.

[bushdav]

same issue on Kali Linux

[OpM3TA]

This proj could probably use some updates, but for now, this will at least get BruteSharkCli "running"

$> export DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1
$> ./BruteSharkCli

As suggested by the error, this will disable globalization, unfortunately, despite the fact it will the run, it does not process files well, and likely won't work.

Heres an excerpt from a trace:

 openat(AT_FDCWD, "/var/tmp/.net/root/BruteSharkCli/2ces1ci1.14i/libdl", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/var/tmp/.net/root/BruteSharkCli/2ces1ci1.14i/libdl", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 53
newfstatat(53, "", {st_mode=S_IFREG|0644, st_size=44171, ...}, AT_EMPTY_PATH) = 0
mmap(NULL, 44171, PROT_READ, MAP_PRIVATE, 53, 0) = 0x7f7cdb06e000
close(53)                               = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libdl", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/libdl", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/libdl", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/libdl", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
munmap(0x7f7cdb06e000, 44171)           = 0

So it can't find libdl, which makes sense, as it was merged with libc:

This may get you running.