Comments (7)
Are you expecting the file to be found relative to the current working directory of your program? Or are you expecting it to be found relative to the directory in which the including file resides?
from go-yara.
Relative to where the including file resides. Usually I have subfolders with rules divided into files. At the top level there are yar-files that include certain files relative to its own location. Using yarac works fine, but compiler.AddFile panics saying that the relative path cannot be found.
from go-yara.
Curious. I just ran into the problem you described today. Without having looked at the commit history, I'm pretty sure that this has to do with a behavior change in libyara. I'll have to investigate further…
from go-yara.
I just created a.yar
containing the following two lines:
include "b.yar"
include "subdir/c.yar"
Both included files exist and are empty.
I can compile this using yarac
from both YARA 3.11 and current master (commit b534f03eecd8a109db2b085ab24d419b6486de97), also with the following little Go test program built with Go 1.13.5 (Linux/amd64) against either version:
package main
import (
"github.com/hillu/go-yara"
"log"
"os"
)
func main() {
c, _ := yara.NewCompiler()
f, _ := os.Open("a.yar")
log.Printf("Using '%s'…", f.Name())
if err := c.AddFile(f, ""); err != nil {
log.Fatalf("addfile: %v", err)
}
if _, err := c.GetRules(); err != nil {
log.Fatalf("compile: %v", err)
}
log.Print("Done.")
}
from go-yara.
@uggwar The problem you encountered may have to do with your ruleset resulting in multiple errors: When I try to compile index.yar
from https://github.com/Yara-Rules/rules with yarac
from a YARA build without Cuckoo support, this results in a number of error messages:
./malware/MALW_AZORULT.yar(5): error: unknown module "cuckoo"
./malware/MALW_AZORULT.yar(23): error: invalid field name "sync"
./malware/MALW_AZORULT.yar(167): error: can't open include file: ./malware/MALW_AgentTesla.yar
./malware/MALW_AZORULT.yar(168): error: can't open include file: ./malware/MALW_AgentTesla_SMTP.yar
./malware/MALW_AZORULT.yar(169): error: can't open include file: ./malware/MALW_AlMashreq.yar
[…]
./malware/MALW_AZORULT.yar(443): error: can't open include file: ./malware/TOOLKIT_THOR_HackTools.yar
./malware/MALW_AZORULT.yar(444): error: can't open include file: ./malware/TOOLKIT_Wineggdrop.yar
./malware/MALW_AZORULT.yar(445): error: can't open include file: ./malware/TOOLKIT_exe2hex_payload.yar
(I am pretty sure that all the "cannot open include file" messages are symptoms of a bug within YARA itself.)
Now, when I use my test program to compile this rule, I only get the following message:
addfile: can't open include file: ./malware/TOOLKIT_exe2hex_payload.yar
This is only the last error reported by YARA. However, all the warnings and errors are stored in (*Compiler).Warnings
and (*Compiler).Errors
, respectively.
from go-yara.
@uggwar Ping? Do you think that my analysis is correct?
from go-yara.
from go-yara.
Related Issues (20)
- There's no way to return an error from MemoryBlockIterator HOT 5
- yr_scanner_scan_file Using mmap is a dangerous operation HOT 9
- Unable to cross compile yara for windows on ubuntu HOT 5
- Is the new tag version expected ? HOT 1
- Issues while installing HOT 7
- Unable to use ScanProc HOT 23
- Unable to define variable on AIX HOT 4
- Scan a file in a streaming maner HOT 2
- Encrypted rules? HOT 4
- unstable rules HOT 5
- Wrong release version? HOT 1
- Building static binary HOT 3
- cannot find -lyara HOT 1
- linux编译yara出现错误 HOT 2
- generate a dynamic-link library (.so file) HOT 1
- v3.x no release tag HOT 1
- Failing to compile with go-yara HOT 9
- yararule.ScanFile, can not scan filepath which contains chinese, may be other language has the same HOT 2
- Attempt to add a new YARA rule files during runtime causes panic HOT 1
- Question: Adding multiple Compiled YARA files to a single yara.Scanner or *yara.Rules HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from go-yara.