kweatherman/yara4ida

Unofficial YARA IDA Pro plugin, along with an unparalleled crypto/hash/compression rule set based on Luigi Auriemma's signsrch signatures.

yara4ida's Issues

Please wait for autoanalysis finish first!, Aborted

The automatic analysis has been completed, but the plugin cannot run

Error in signsrch yara rules

I am using IDA v7.7.
The Output log is:

Yara4Ida: v1.0.0, built Jun 11 2022
Loading rules from: "Z:\IDA\usrdir\plugins\yara4ida_rules\signsrch\signsrch_le.yar"
1,156 rules loaded in 130.9ms

Yara4Ida: Using single threaded scanning.
Walking segments:
"HEADER", DATA, 10000000 - 10001000, 4 KB
".text", CODE, 10001000 - 10008000, 28 KB
".rdata", DATA, 10008104 - 1000D000, 19.7 KB
".data", DATA, 1000D000 - 1000F000, 8 KB
".reloc", DATA, 1000F000 - 10011000, 8 KB

Scanning:
** ConcurrentCallbackGroup::Poll() scanning failed! HR: 0x80004005 "Unspecified error", Total errors: 4 **
Destructing ConcurrentCallbackGroup object.

• Aborted *

Try with another file: signsrch_be.yar, signsrch_le_be.yar, the error is same.

Try with crypto_signatures.yar, plugin run OK.

Yara4Ida: v1.0.0, built Jun 11 2022
Loading rules from: "C:\Sandbox\crypto_signatures.yar"

Rule compile WARNING:
File: "C:\Sandbox\crypto_signatures.yar", line: 11
Reason: "string "$c0" may slow down scanning"

Rule compile WARNING:
File: "C:\Sandbox\crypto_signatures.yar", line: 23
Reason: "string "$c0" may slow down scanning"

Rule compile WARNING:
File: "C:\Sandbox\crypto_signatures.yar", line: 35
Reason: "string "$c0" may slow down scanning"

Rule compile WARNING:
File: "C:\Sandbox\crypto_signatures.yar", line: 47
Reason: "string "$c0" may slow down scanning"

Rule compile WARNING:
File: "C:\Sandbox\crypto_signatures.yar", line: 59
Reason: "string "$c0" may slow down scanning"

Rule compile WARNING:
File: "C:\Sandbox\crypto_signatures.yar", line: 71
Reason: "string "$c0" may slow down scanning"
122 rules loaded in 19.1ms

Yara4Ida: Using single threaded scanning.
Walking segments:
"HEADER", DATA, 10000000 - 10001000, 4 KB
".text", CODE, 10001000 - 10008000, 28 KB
".rdata", DATA, 10008104 - 1000D000, 19.7 KB
".data", DATA, 1000D000 - 1000F000, 8 KB
".reloc", DATA, 1000F000 - 10011000, 8 KB

Scanning:
[0] "HEADER"
[1] ".text"
[2] ".rdata", 1 matches
[3] ".data"
[4] ".reloc"

Destructing ConcurrentCallbackGroup object.
Yara4Ida: Found 1 matches in 191.0ms

• Aborted *

The result chooser window showed, but I don't known why "* Aborted *"
My machine, CPU 12 cores.