diff --git a/.bazelrc b/.bazelrc deleted file mode 100644 index a68e0702..00000000 --- a/.bazelrc +++ /dev/null @@ -1,2 +0,0 @@ -# Build in C++17 mode without a custom CROSSTOOL -build --cxxopt=-std=c++17 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 829194d5..8f2b5752 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -104,27 +104,6 @@ jobs: if: ${{ failure() }} run: cat test-suite.log - bazel-build: - # The ubuntu-20.04 virtual environment has Bazel installed, see: - # https://github.com/actions/virtual-environments - runs-on: ubuntu-20.04 - steps: - # Caches and restores the bazelisk download directory. - # - name: Cache bazelisk download - # uses: actions/cache@v4 - # env: - # cache-name: bazel-cache - # with: - # path: ~/.cache/bazelisk - # key: ${{ runner.os }}-${{ env.cache-name }}-${{ github.ref }} - # restore-keys: | - # ${{ runner.os }}-${{ env.cache-name }} - - uses: actions/checkout@v2 - - name: Build - run: bazel build @jansson//... //tests/... - - name: Run tests - run: bazel test --test_output=errors //tests/... - bigendian: runs-on: ubuntu-latest steps: diff --git a/BUILD.bazel b/BUILD.bazel deleted file mode 100644 index 21666869..00000000 --- a/BUILD.bazel +++ /dev/null @@ -1,143 +0,0 @@ -# Copyright (c) 2019. The YARA Authors. All Rights Reserved. -# -# Redistribution and use in source and binary forms, with or without modification, -# are permitted provided that the following conditions are met: -# -# 1. Redistributions of source code must retain the above copyright notice, this -# list of conditions and the following disclaimer. -# -# 2. Redistributions in binary form must reproduce the above copyright notice, -# this list of conditions and the following disclaimer in the documentation and/or -# other materials provided with the distribution. -# -# 3. Neither the name of the copyright holder nor the names of its contributors -# may be used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON -# ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -# Bazel (http://bazel.io/) WORKSPACE file for YARA. - -load("@com_github_virustotal_yara//:bazel/yara.bzl", "yara_library") - -# Just YARA's error codes. This is useful for sandboxing as it avoids pulling -# in the whole library. -cc_library( - name = "yara_errors", - hdrs = ["libyara/include/yara/error.h"], - visibility = ["//visibility:public"], -) - -# Configuration setting for enabling profiling. Usage: -# bazel build ... --define yara_profiling=enabled -config_setting( - name = "profiling_enabled", - values = {"define": "yara_profiling=enabled"}, -) - -# Configuration setting for using BoringSSL instead of OpenSSL. Notice that -# some features related to PE signatures in the "pe" module will be disabled -# because of missing functionality in BoringSSL. Usage: -# bazel build ... --define yara_crypto_library=boringssl -config_setting( - name = "crypto_library_boringssl", - values = {"define": "yara_crypto_library=boringssl"}, -) - -yara_library( - name = "libyara", - crypto_libs = select({ - ":crypto_library_boringssl": ["@boringssl//:crypto"], - "//conditions:default": ["@openssl//:crypto"], - }), - defines = select({ - ":profiling_enabled": ["YR_PROFILING_ENABLED"], - "//conditions:default": [], - }) + select({ - ":crypto_library_boringssl": ["BORINGSSL"], - "//conditions:default": [], - }), - modules = [ - "cuckoo", - "dex", - "dotnet", - "elf", - "hash", - "macho", - "magic", - "math", - "pe", - "tests", - "time", - "console", - "string", - ], - modules_srcs = [ - "libyara/modules/cuckoo/cuckoo.c", - "libyara/modules/dex/dex.c", - "libyara/modules/dotnet/dotnet.c", - "libyara/modules/elf/elf.c", - "libyara/modules/hash/hash.c", - "libyara/modules/magic/magic.c", - "libyara/modules/macho/macho.c", - "libyara/modules/math/math.c", - "libyara/modules/pe/pe.c", - "libyara/modules/pe/pe_utils.c", - "libyara/modules/tests/tests.c", - "libyara/modules/time/time.c", - "libyara/modules/console/console.c", - "libyara/modules/string/string.c", - ], - deps = [ - "@jansson", - "@magic", - ], -) - -# Code shared by the command-line tools. -cc_library( - name = "cli_shared", - srcs = [ - "cli/args.c", - "cli/common.c", - "cli/threading.c", - ], - hdrs = [ - "cli/args.h", - "cli/common.h", - "cli/threading.h", - "cli/unicode.h", - ], - deps = [":libyara"], -) - -# YARA command-line tool -cc_binary( - name = "yara", - srcs = ["cli/yara.c"], - visibility = ["//visibility:public"], - deps = [ - ":cli_shared", - ":libyara", - ], -) - -# YARA compiler -cc_binary( - name = "yarac", - srcs = ["cli/yarac.c"], - visibility = ["//visibility:public"], - deps = [ - ":cli_shared", - ":libyara", - ], -) diff --git a/Makefile.am b/Makefile.am index ef4fd47c..c81d7694 100644 --- a/Makefile.am +++ b/Makefile.am @@ -290,6 +290,7 @@ yara_SOURCES = \ cli/yara.c yara_LDADD = libyara.la +yara_LDFLAGS = -static yarac_SOURCES = \ cli/args.c \ diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel deleted file mode 100644 index bf960dcc..00000000 --- a/WORKSPACE.bazel +++ /dev/null @@ -1,51 +0,0 @@ -# Copyright (c) 2019. The YARA Authors. All Rights Reserved. -# -# Redistribution and use in source and binary forms, with or without modification, -# are permitted provided that the following conditions are met: -# -# 1. Redistributions of source code must retain the above copyright notice, this -# list of conditions and the following disclaimer. -# -# 2. Redistributions in binary form must reproduce the above copyright notice, -# this list of conditions and the following disclaimer in the documentation and/or -# other materials provided with the distribution. -# -# 3. Neither the name of the copyright holder nor the names of its contributors -# may be used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON -# ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -# Bazel (http://bazel.io/) WORKSPACE file for YARA. - -workspace(name = "com_github_virustotal_yara") - -load("//:bazel/yara_deps.bzl", "yara_deps") - -yara_deps() - -load( - "@rules_proto//proto:repositories.bzl", - "rules_proto_dependencies", - "rules_proto_toolchains", -) - -rules_proto_dependencies() - -rules_proto_toolchains() - -load( - "@com_google_sandboxed_api//sandboxed_api/bazel:sapi_deps.bzl", - "sapi_deps", -) - -sapi_deps() diff --git a/bazel/jansson.BUILD b/bazel/jansson.BUILD deleted file mode 100644 index fd4a4bbc..00000000 --- a/bazel/jansson.BUILD +++ /dev/null @@ -1,99 +0,0 @@ -# Copyright (c) 2020. The YARA Authors. All Rights Reserved. -# -# Redistribution and use in source and binary forms, with or without modification, -# are permitted provided that the following conditions are met: -# -# 1. Redistributions of source code must retain the above copyright notice, this -# list of conditions and the following disclaimer. -# -# 2. Redistributions in binary form must reproduce the above copyright notice, -# this list of conditions and the following disclaimer in the documentation and/or -# other materials provided with the distribution. -# -# 3. Neither the name of the copyright holder nor the names of its contributors -# may be used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON -# ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -# Bazel (http://bazel.io/) BUILD file for the jansson library. - -load("@com_github_virustotal_yara//:bazel/jansson.bzl", "jansson_api_test") - -# Rule for generating header files required during the build. These header files -# are normally generated by ./configure, but we just create empty files so that -# #include statements can find them. -genrule( - name = "config_files", - outs = [ - "jansson_config.h", - "jansson_private_config.h", - ], - cmd = """ - touch $(location jansson_config.h) - touch $(location jansson_private_config.h) - """, -) - -cc_library( - name = "jansson", - srcs = glob(["src/*.c"]), - hdrs = glob(["src/*.h"]) + [ - "jansson_config.h", - "jansson_private_config.h", - ], - copts = ["-Wno-unused-function"], - # These defines are usually in jansson_config.h but we define them here, - # as jansson_config.h is just an empty file. - defines = [ - "HAVE_STDINT_H=1", - "JSON_INLINE=inline", - "JSON_PARSER_MAX_DEPTH=2048", - ], - includes = [ - ".", - "src", - ], - visibility = ["//visibility:public"], -) - -jansson_api_test(name = "test_array") - -jansson_api_test(name = "test_chaos") - -jansson_api_test(name = "test_copy") - -jansson_api_test(name = "test_dump") - -jansson_api_test(name = "test_dump_callback") - -jansson_api_test(name = "test_equal") - -jansson_api_test(name = "test_load") - -jansson_api_test(name = "test_load_callback") - -jansson_api_test(name = "test_loadb") - -jansson_api_test(name = "test_memory_funcs") - -jansson_api_test(name = "test_number") - -jansson_api_test(name = "test_object") - -jansson_api_test(name = "test_pack") - -jansson_api_test(name = "test_simple") - -jansson_api_test(name = "test_sprintf") - -jansson_api_test(name = "test_unpack") diff --git a/bazel/jansson.bzl b/bazel/jansson.bzl deleted file mode 100644 index 21e5dbad..00000000 --- a/bazel/jansson.bzl +++ /dev/null @@ -1,38 +0,0 @@ -# Copyright (c) 2020. The YARA Authors. All Rights Reserved. -# -# Redistribution and use in source and binary forms, with or without modification, -# are permitted provided that the following conditions are met: -# -# 1. Redistributions of source code must retain the above copyright notice, this -# list of conditions and the following disclaimer. -# -# 2. Redistributions in binary form must reproduce the above copyright notice, -# this list of conditions and the following disclaimer in the documentation and/or -# other materials provided with the distribution. -# -# 3. Neither the name of the copyright holder nor the names of its contributors -# may be used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON -# ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -"""Rule for defining test cases for the jansson library.""" - -def jansson_api_test(name): - native.cc_test( - name = name, - srcs = [ - "test/suites/api/util.h", - "test/suites/api/" + name + ".c", - ], - deps = [":jansson"], - ) diff --git a/bazel/magic.BUILD b/bazel/magic.BUILD deleted file mode 100644 index 710489d9..00000000 --- a/bazel/magic.BUILD +++ /dev/null @@ -1,143 +0,0 @@ -# Copyright (c) 2020. The YARA Authors. All Rights Reserved. -# -# Redistribution and use in source and binary forms, with or without modification, -# are permitted provided that the following conditions are met: -# -# 1. Redistributions of source code must retain the above copyright notice, this -# list of conditions and the following disclaimer. -# -# 2. Redistributions in binary form must reproduce the above copyright notice, -# this list of conditions and the following disclaimer in the documentation and/or -# other materials provided with the distribution. -# -# 3. Neither the name of the copyright holder nor the names of its contributors -# may be used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON -# ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -# Bazel (http://bazel.io/) BUILD file for the libmagic library. - -# Rule for creating magic.h from magic.h.in. The two files are identical, except -# for magic.h.in not having the actual version number. Instead it has a X.YY -# placeholder that is replaced with the version number (i.e: 545) during build -# time. When this library is updated the version number in this rule must be -# updated accordingly. -genrule( - name = "magic_h", - srcs = ["src/magic.h.in"], - outs = ["src/magic.h"], - cmd = """ - sed -e 's/X.YY/545/' < $(location src/magic.h.in) > $(location src/magic.h) - """, -) - -MAGIC_COPTS = [ - # The VERSION macro usually contains the actual version (e.g: "5.38") but - # any arbitrary string will work. We simply use "BUILT_BY_YARA". - "-DVERSION=\\\"BUILT_BY_YARA\\\"", -] + select({ - "@bazel_tools//src/conditions:darwin": [ - "-DHAVE_FORK=1", - "-DHAVE_INTTYPES_H=1", - "-DHAVE_STDINT_H=1", - "-DHAVE_STRLCAT=1", - "-DHAVE_STRLCPY=1", - "-DHAVE_UNISTD_H=1", - ], - "@bazel_tools//src/conditions:freebsd": [ - "-DHAVE_FORK=1", - "-DHAVE_INTTYPES_H=1", - "-DHAVE_STDINT_H=1", - "-DHAVE_STRLCAT=1", - "-DHAVE_STRLCPY=1", - "-DHAVE_UNISTD_H=1", - ], - "@bazel_tools//src/conditions:linux_aarch64": [ - "-DHAVE_FORK=1", - "-DHAVE_INTTYPES_H=1", - "-DHAVE_STDINT_H=1", - "-DHAVE_UNISTD_H=1", - ], - "@bazel_tools//src/conditions:linux_x86_64": [ - "-DHAVE_FORK=1", - "-DHAVE_INTTYPES_H=1", - "-DHAVE_STDINT_H=1", - "-DHAVE_UNISTD_H=1", - "-DHAVE_MKSTEMP=1", - ], - "@bazel_tools//src/conditions:windows": [ - ], -}) - -cc_library( - name = "magic", - srcs = glob(["src/*.h"]) + [ - "src/apprentice.c", - "src/apptype.c", - "src/ascmagic.c", - "src/asctime_r.c", - "src/asprintf.c", - "src/buffer.c", - "src/cdf.c", - "src/cdf_time.c", - "src/compress.c", - "src/ctime_r.c", - "src/der.c", - "src/dprintf.c", - "src/encoding.c", - "src/fmtcheck.c", - "src/fsmagic.c", - "src/funcs.c", - "src/getline.c", - "src/getopt_long.c", - "src/gmtime_r.c", - "src/is_csv.c", - "src/is_json.c", - "src/is_simh.c", - "src/is_tar.c", - "src/localtime_r.c", - "src/magic.c", - "src/pread.c", - "src/print.c", - "src/readcdf.c", - "src/readelf.c", - "src/seccomp.c", - "src/softmagic.c", - "src/strcasestr.c", - "src/vasprintf.c", - ] + select({ - "@bazel_tools//src/conditions:darwin": [ - ], - "@bazel_tools//src/conditions:freebsd": [ - ], - "@bazel_tools//src/conditions:linux_aarch64": [ - "src/strlcat.c", - "src/strlcpy.c", - ], - "@bazel_tools//src/conditions:linux_x86_64": [ - "src/strlcat.c", - "src/strlcpy.c", - ], - "@bazel_tools//src/conditions:windows": [ - "src/strlcat.c", - "src/strlcpy.c", - ], - }), - hdrs = ["src/magic.h"], - copts = MAGIC_COPTS, - includes = [ - ".", - "src", - ], - visibility = ["//visibility:public"], -) diff --git a/bazel/openssl.BUILD b/bazel/openssl.BUILD deleted file mode 100644 index 999f088a..00000000 --- a/bazel/openssl.BUILD +++ /dev/null @@ -1,89 +0,0 @@ -# Copyright (c) 2020. The YARA Authors. All Rights Reserved. -# -# Redistribution and use in source and binary forms, with or without modification, -# are permitted provided that the following conditions are met: -# -# 1. Redistributions of source code must retain the above copyright notice, this -# list of conditions and the following disclaimer. -# -# 2. Redistributions in binary form must reproduce the above copyright notice, -# this list of conditions and the following disclaimer in the documentation and/or -# other materials provided with the distribution. -# -# 3. Neither the name of the copyright holder nor the names of its contributors -# may be used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON -# ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -# Bazel (http://bazel.io/) BUILD file for openssl library which is a dependency -# for YARA. - -config_setting( - name = "darwin", - values = { - "cpu": "darwin_x86_64", - }, -) - -cc_library( - name = "crypto", - srcs = ["libcrypto.a"], - hdrs = glob(["include/openssl/*.h"]) + ["include/openssl/opensslconf.h"], - includes = ["include"], - linkopts = select({ - ":darwin": [], - "//conditions:default": [ - "-lpthread", - "-ldl", - ], - }), - visibility = ["//visibility:public"], -) - -cc_library( - name = "ssl", - srcs = ["libssl.a"], - hdrs = glob(["include/openssl/*.h"]) + ["include/openssl/opensslconf.h"], - includes = ["include"], - visibility = ["//visibility:public"], - deps = [":crypto"], -) - -genrule( - name = "openssl-build", - srcs = glob( - ["**/*"], - exclude = ["bazel-*"], - ), - outs = [ - "libcrypto.a", - "libssl.a", - "include/openssl/opensslconf.h", - ], - cmd = """ - CONFIG_LOG=$$(mktemp) - MAKE_LOG=$$(mktemp) - OPENSSL_ROOT=$$(dirname $(location config)) - pushd $$OPENSSL_ROOT > /dev/null - if ! ./config > $$CONFIG_LOG; then - cat $$CONFIG_LOG - fi - if ! make -j 4 > $$MAKE_LOG; then - cat $$MAKE_LOG - fi - popd > /dev/null - cp $$OPENSSL_ROOT/libcrypto.a $(location libcrypto.a) - cp $$OPENSSL_ROOT/libssl.a $(location libssl.a) - cp $$OPENSSL_ROOT/include/openssl/opensslconf.h $(location include/openssl/opensslconf.h) - """, -) diff --git a/bazel/yara.bzl b/bazel/yara.bzl deleted file mode 100644 index ff4834b4..00000000 --- a/bazel/yara.bzl +++ /dev/null @@ -1,263 +0,0 @@ -# Copyright (c) 2020. The YARA Authors. All Rights Reserved. -# -# Redistribution and use in source and binary forms, with or without modification, -# are permitted provided that the following conditions are met: -# -# 1. Redistributions of source code must retain the above copyright notice, this -# list of conditions and the following disclaimer. -# -# 2. Redistributions in binary form must reproduce the above copyright notice, -# this list of conditions and the following disclaimer in the documentation and/or -# other materials provided with the distribution. -# -# 3. Neither the name of the copyright holder nor the names of its contributors -# may be used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON -# ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -"""Bazel rules for building YARA.""" - -YARA_CONFIG_OPTS = [ - "-DHAVE_CLOCK_GETTIME=1", - #"-DHAVE_COMMONCRYPTO_COMMONCRYPTO_H", - "-DHAVE_LIBCRYPTO=1", - "-DHAVE_MEMMEM=1", - "-DHAVE_STDBOOL_H=1", - # "-DHAVE__MKGMTIME=1", - "-DHAVE_TIMEGM=1", - "-DBUCKETS_128=1", # Defining TLSH function - "-DCHECKSUM_1B=1", # Defining TLSH function -] - -YARA_COPTS = YARA_CONFIG_OPTS + [ - "-D_GNU_SOURCE", - "-O3", - "-DNDEBUG", - # Tell the compiler we want the C99 standard. - "-std=c99", - # Additional include paths. - "-Ilibyara", - "-Ilibyara/modules", -] + select({ - "@bazel_tools//src/conditions:darwin": [ - "-DUSE_MACH_PROC", - "-DHAVE_SCAN_PROC_IMPL=1", - "-DHAVE_STRLCAT=1", - "-DHAVE_STRLCPY=1", - ], - "@bazel_tools//src/conditions:freebsd": [ - "-DUSE_FREEBSD_PROC", - "-DHAVE_SCAN_PROC_IMPL=1", - "-DHAVE_STRLCAT=1", - "-DHAVE_STRLCPY=1", - ], - "@bazel_tools//src/conditions:linux_aarch64": [ - "-DUSE_LINUX_PROC", - "-DHAVE_SCAN_PROC_IMPL=1", - ], - "@bazel_tools//src/conditions:linux_x86_64": [ - "-DUSE_LINUX_PROC", - "-DHAVE_SCAN_PROC_IMPL=1", - ], - "@bazel_tools//src/conditions:windows": [ - "-DUSE_WINDOWS_PROC", - "-DHAVE_SCAN_PROC_IMPL=1", - ], - "//conditions:default": ["-DUSE_NO_PROC"], -}) - -# Define rule for generating the module_list file. This rule has an attribute -# "modules" which is a list of module names that we want in the file. -def _module_list_impl(ctx): - output = ctx.outputs.out - content = "\n".join(["MODULE(%s)" % m for m in ctx.attr.modules]) - ctx.actions.write(output = output, content = content) - -module_list = rule( - implementation = _module_list_impl, - attrs = {"modules": attr.string_list()}, - outputs = {"out": "libyara/modules/module_list"}, -) - -def yara_library( - name, - defines = [], - includes = [], - modules = [], - modules_srcs = [], - deps = [], - copts = YARA_COPTS, - crypto_libs = ["@openssl//:crypto"]): - """Macro for generating the YARA library with a specific list of modules. - - This macro allows to cherry-pick the modules that you want to build into the - library. For example, for building it with modules pe and elf only, you can - use: - - yara_library( - name = "libyara", - modules = [ - "cuckoo", - "dex", - "dotnet", - "elf", - ], - modules_srcs = [ - "libyara/modules/elf/elf.c", - "libyara/modules/pe/pe.c", - "libyara/modules/pe/pe_utils.c", - ] - ) - - The "modules_srcs" list must contain the source files implementing the modules - listed in the "modules" argument. - """ - module_list( - name = "module_list", - modules = modules, - ) - - native.cc_library( - name = name, - defines = defines + [m.upper() + "_MODULE" for m in modules], - srcs = modules_srcs + [ - "libyara/ahocorasick.c", - "libyara/arena.c", - "libyara/atoms.c", - "libyara/base64.c", - "libyara/bitmask.c", - "libyara/compiler.c", - "libyara/crypto.h", - "libyara/endian.c", - "libyara/exception.h", - "libyara/exec.c", - "libyara/exefiles.c", - "libyara/filemap.c", - "libyara/grammar.c", - "libyara/hash.c", - "libyara/hex_grammar.c", - "libyara/hex_grammar.h", - "libyara/hex_lexer.c", - "libyara/include/yara.h", - "libyara/include/yara/ahocorasick.h", - "libyara/include/yara/arena.h", - "libyara/include/yara/atoms.h", - "libyara/include/yara/base64.h", - "libyara/include/yara/bitmask.h", - "libyara/include/yara/compiler.h", - "libyara/include/yara/dex.h", - "libyara/include/yara/dotnet.h", - "libyara/include/yara/elf.h", - "libyara/include/yara/elf_utils.h", - "libyara/include/yara/endian.h", - "libyara/include/yara/error.h", - "libyara/include/yara/exec.h", - "libyara/include/yara/exefiles.h", - "libyara/include/yara/filemap.h", - "libyara/include/yara/globals.h", - "libyara/include/yara/hash.h", - "libyara/include/yara/hex_lexer.h", - "libyara/include/yara/integers.h", - "libyara/include/yara/lexer.h", - "libyara/include/yara/libyara.h", - "libyara/include/yara/limits.h", - "libyara/include/yara/macho.h", - "libyara/include/yara/mem.h", - "libyara/include/yara/modules.h", - "libyara/include/yara/notebook.h", - "libyara/include/yara/object.h", - "libyara/include/yara/parser.h", - "libyara/include/yara/pe.h", - "libyara/include/yara/pe_utils.h", - "libyara/include/yara/proc.h", - "libyara/include/yara/re.h", - "libyara/include/yara/re_lexer.h", - "libyara/include/yara/rules.h", - "libyara/include/yara/scan.h", - "libyara/include/yara/scanner.h", - "libyara/include/yara/simple_str.h", - "libyara/include/yara/sizedstr.h", - "libyara/include/yara/stack.h", - "libyara/include/yara/stopwatch.h", - "libyara/include/yara/stream.h", - "libyara/include/yara/strutils.h", - "libyara/include/yara/threading.h", - "libyara/include/yara/types.h", - "libyara/include/yara/unaligned.h", - "libyara/include/yara/utils.h", - "libyara/include/tlshc/tlsh.h", - "libyara/lexer.c", - "libyara/libyara.c", - "libyara/mem.c", - "libyara/modules.c", - "libyara/notebook.c", - "libyara/object.c", - "libyara/parser.c", - "libyara/proc.c", - "libyara/proc/freebsd.c", - "libyara/proc/linux.c", - "libyara/proc/mach.c", - "libyara/proc/none.c", - "libyara/proc/openbsd.c", - "libyara/proc/windows.c", - "libyara/re.c", - "libyara/re_grammar.c", - "libyara/re_grammar.h", - "libyara/re_lexer.c", - "libyara/rules.c", - "libyara/scan.c", - "libyara/scanner.c", - "libyara/simple_str.c", - "libyara/sizedstr.c", - "libyara/stack.c", - "libyara/stopwatch.c", - "libyara/stream.c", - "libyara/strutils.c", - "libyara/threading.c", - "libyara/include/authenticode-parser/authenticode.h", - "libyara/modules/pe/authenticode-parser/authenticode.c", - "libyara/modules/pe/authenticode-parser/certificate.c", - "libyara/modules/pe/authenticode-parser/certificate.h", - "libyara/modules/pe/authenticode-parser/countersignature.c", - "libyara/modules/pe/authenticode-parser/countersignature.h", - "libyara/modules/pe/authenticode-parser/helper.c", - "libyara/modules/pe/authenticode-parser/helper.h", - "libyara/modules/pe/authenticode-parser/structs.c", - "libyara/modules/pe/authenticode-parser/structs.h", - "libyara/tlshc/tlsh.c", - "libyara/tlshc/tlsh_impl.c", - "libyara/tlshc/tlsh_impl.h", - "libyara/tlshc/tlsh_util.c", - "libyara/tlshc/tlsh_util.h", - ], - hdrs = [ - "libyara/include/yara.h", - "libyara/include/yara/pe.h", - "libyara/include/yara/proc.h", - "libyara/include/yara/rules.h", - ], - copts = copts, - includes = includes + [ - "libyara/modules", - "libyara/include", - "libyara", - ], - textual_hdrs = [ - ":module_list", - "libyara/grammar.h", - "libyara/hex_grammar.y", - "libyara/re_grammar.y", - ], - deps = deps + crypto_libs, - visibility = ["//visibility:public"], - ) diff --git a/bazel/yara_deps.bzl b/bazel/yara_deps.bzl deleted file mode 100644 index 14fb3c03..00000000 --- a/bazel/yara_deps.bzl +++ /dev/null @@ -1,93 +0,0 @@ -# Copyright (c) 2020. The YARA Authors. All Rights Reserved. -# -# Redistribution and use in source and binary forms, with or without modification, -# are permitted provided that the following conditions are met: -# -# 1. Redistributions of source code must retain the above copyright notice, this -# list of conditions and the following disclaimer. -# -# 2. Redistributions in binary form must reproduce the above copyright notice, -# this list of conditions and the following disclaimer in the documentation and/or -# other materials provided with the distribution. -# -# 3. Neither the name of the copyright holder nor the names of its contributors -# may be used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON -# ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -"""Load dependencies needed to compile YARA as a 3rd-party consumer.""" - -load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository") -load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") -load("@bazel_tools//tools/build_defs/repo:utils.bzl", "maybe") - -def yara_deps(): - """Loads common dependencies needed to compile YARA.""" - maybe( - http_archive, - name = "openssl", - url = "https://github.com/openssl/openssl/archive/refs/tags/OpenSSL_1_1_1n.tar.gz", - sha256 = "6b2d2440ced8c802aaa61475919f0870ec556694c466ebea460e35ea2b14839e", - strip_prefix = "openssl-OpenSSL_1_1_1n", - build_file = "@com_github_virustotal_yara//:bazel/openssl.BUILD", - ) - maybe( - git_repository, - name = "boringssl", - commit = "095d78b14f91cc9a910408eaae84a3bdafc54da9", # 2019-06-05 - remote = "https://boringssl.googlesource.com/boringssl", - shallow_since = "1559759280 +0000", - ) - maybe( - http_archive, - name = "jansson", - url = "https://github.com/akheron/jansson/archive/v2.14.tar.gz", - sha256 = "c739578bf6b764aa0752db9a2fdadcfe921c78f1228c7ec0bb47fa804c55d17b", - strip_prefix = "jansson-2.14", - build_file = "@com_github_virustotal_yara//:bazel/jansson.BUILD", - ) - maybe( - # When updating this dependency to a more recent version, the version - # in the bazel/magic.BUILD must be updated acordingly. - http_archive, - name = "magic", - url = "https://github.com/file/file/archive/FILE5_45.tar.gz", - sha256 = "28c01a5ef1a127ef71758222ca019ba6c6bfa4a8fe20c2b525ce75943ee9da3c", - strip_prefix = "file-FILE5_45", - build_file = "@com_github_virustotal_yara//:bazel/magic.BUILD", - ) - maybe( - git_repository, - name = "com_google_sandboxed_api", - commit = "144a441d798f13d27cc71e7c2a630e0063d747b5", # 2020-05-12 - remote = "https://github.com/google/sandboxed-api.git", - shallow_since = "1589270865 -0700", - ) - maybe( - http_archive, - name = "rules_proto", - sha256 = "602e7161d9195e50246177e7c55b2f39950a9cf7366f74ed5f22fd45750cd208", - strip_prefix = "rules_proto-97d8af4dc474595af3900dd85cb3a29ad28cc313", - urls = [ - "https://mirror.bazel.build/github.com/bazelbuild/rules_proto/archive/97d8af4dc474595af3900dd85cb3a29ad28cc313.tar.gz", - "https://github.com/bazelbuild/rules_proto/archive/97d8af4dc474595af3900dd85cb3a29ad28cc313.tar.gz", - ], - ) - maybe( - # GoogleTest/GoogleMock for testing the sandbox - http_archive, - name = "com_google_googletest", - sha256 = "ba5b04a4849246e7c16ba94227eed46486ef942f61dc8b78609732543c19c9f4", # 2019-11-21 - strip_prefix = "googletest-200ff599496e20f4e39566feeaf2f6734ca7570f", - urls = ["https://github.com/google/googletest/archive/200ff599496e20f4e39566feeaf2f6734ca7570f.zip"], - ) diff --git a/configure.ac b/configure.ac index 5ffba1f5..be649f60 100644 --- a/configure.ac +++ b/configure.ac @@ -20,8 +20,6 @@ no_std_allocator="-fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc - m4_ifdef([AM_PROG_AR], [AM_PROG_AR]) AC_PROG_CC -AC_PROG_CC_C99 -AM_PROG_CC_C_O AM_PROG_LEX AC_PROG_YACC diff --git a/libyara/include/yara/limits.h b/libyara/include/yara/limits.h index 1e2c7823..8285acd6 100644 --- a/libyara/include/yara/limits.h +++ b/libyara/include/yara/limits.h @@ -113,8 +113,8 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #define YR_MAX_STRING_MATCHES 1000000 #endif -// The number of matches before detecting slow scanning. If more matches are found -// the scan will have a CALLBACK_MSG_TOO_SLOW_SCANNING. +// The number of matches before detecting slow scanning. If more matches are +// found the scan will have a CALLBACK_MSG_TOO_SLOW_SCANNING. #ifndef YR_SLOW_STRING_MATCHES #define YR_SLOW_STRING_MATCHES 600000 #endif @@ -171,7 +171,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. // Maximum input size scanned by yr_re_exec and yr_re_fast_exec #ifndef YR_RE_SCAN_LIMIT -#define YR_RE_SCAN_LIMIT 4096 +#define YR_RE_SCAN_LIMIT 1024 #endif // Maximum number of fibers diff --git a/libyara/yara.pc b/libyara/yara.pc new file mode 100644 index 00000000..b1e03e6c --- /dev/null +++ b/libyara/yara.pc @@ -0,0 +1,13 @@ +prefix=/usr/local +exec_prefix=${prefix} +includedir=${prefix}/include +libdir=${exec_prefix}/lib + +Name: yara +Description: YARA library +URL: https://virustotal.github.io/yara/ +Version: 4.2.2 +Requires.private: libcrypto +Cflags: -I${includedir} +Libs: -L${libdir} -lyara +Libs.private: -lm diff --git a/test.rules b/test.rules new file mode 100644 index 00000000..7248ac93 --- /dev/null +++ b/test.rules @@ -0,0 +1 @@ +rule t { condition: true } diff --git a/test.yar b/test.yar new file mode 100644 index 00000000..5c681f1a --- /dev/null +++ b/test.yar @@ -0,0 +1,50 @@ +import "pe" + +rule M_Dropper_DRIPDRIVE_2 { + meta: + author = "Mandiant" + md5 = "c8ebaf77bb9905ef84b28510de6c9d0e" + date_created = "2024-01-08" + date_modified = "2024-01-08" + rev = "1" + strings: + $s1 = "########:download ok!" ascii wide + $s2 = "########:run command line:" ascii wide + $s3 = "########:start install cef!" ascii wide + $s4 = "/install" wide + $s5 = "/update" wide + $s6 = "MachineGuid" wide + $s7 = "SOFTWARE\\Microsoft\\Cryptography" wide + $asm1 = { 84 C0 75 ?? 2B F1 0F 57 C0 66 0F 13 44 24 ?? 39 5C 24 ?? 7C ?? 8B 7C 24 ?? 7F ?? 3B FB 76 ?? 8B 44 24 ?? 8B 4C 24 ?? 89 44 24 ?? 89 4C 24 ?? 53 56 50 51 E8 ?? ?? ?? ?? 8B 4C 24 ?? 8B 54 24 ?? 8A 44 04 ?? 30 04 11 83 C1 01 8B 44 24 ?? 13 C3 89 4C 24 ?? 89 44 24 ?? 3B 44 24 ?? 7C ?? 7F ?? 3B CF 72 ?? } + condition: + (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (for any i in (0 .. pe.number_of_resources - 1) : ( pe.resources[i].type_string == "F\x00I\x00L\x00E\x00" )) and (4 of ($s*)) and (all of ($asm*)) +} + +import "pe" + +rule M_APT_Dropper_DRIPDRIVE_1 { + meta: + author = "Mandiant" + date_created = "2024-02-06" + date_modified = "2024-02-06" + md5 = "cc3b8573e7955c3fa90d98343f389732" + rev = 1 + strings: + $str1 = "########:start install cef!" + $str2 = "########:delete xp file:%s!" + $str3 = "########:install cef ok!" + $str4 = "########:start update cef!" + $str5 = "########:no use update and run wintool!" + $str6 = "########:download update!" + $str7 = "########:download failed!" + $str8 = "########:download ok!" + $str9 = "decrypt ok!" + $str10 = "########:install update close!" + $str11 = "########:run command line" wide fullword + $p1 = "Global\\GUID(A3AC453A-543D-4FC6-9465-F8897B8F67E5)" wide fullword + $p2 = "/install" wide fullword + $p3 = "/update" wide fullword + $p4 = "TASKKILL /F /IM %s" wide fullword + condition: + uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and 8 of ($str*) and all of ($p*) and for any i in (0 .. pe.number_of_resources - 1) : ( pe.resources[i].type_string == "F\x00I\x00L\x00E\x00" ) +} diff --git a/tests/BUILD.bazel b/tests/BUILD.bazel deleted file mode 100644 index faabb5ba..00000000 --- a/tests/BUILD.bazel +++ /dev/null @@ -1,282 +0,0 @@ -# Copyright (c) 2019. The YARA Authors. All Rights Reserved. -# -# Redistribution and use in source and binary forms, with or without modification, -# are permitted provided that the following conditions are met: -# -# 1. Redistributions of source code must retain the above copyright notice, this -# list of conditions and the following disclaimer. -# -# 2. Redistributions in binary form must reproduce the above copyright notice, -# this list of conditions and the following disclaimer in the documentation and/or -# other materials provided with the distribution. -# -# 3. Neither the name of the copyright holder nor the names of its contributors -# may be used to endorse or promote products derived from this software without -# specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON -# ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -COPTS = [ - "-D_GNU_SOURCE", - "-DHAVE_STDBOOL_H=1", - # Tell the compiler we want the C99 standard. - "-std=c99", -] - -cc_library( - name = "blob", - hdrs = ["blob.h"], -) - -cc_library( - name = "util", - srcs = ["util.c"], - copts = COPTS, - textual_hdrs = ["util.h"], - deps = ["@//:libyara"], -) - -cc_test( - name = "test_alignment", - srcs = ["test-alignment.c"], - copts = COPTS, - linkstatic = True, - deps = [ - ":util", - "@//:libyara", - ], -) - -cc_test( - name = "test_arena", - srcs = ["test-arena.c"], - copts = COPTS, - linkstatic = True, - deps = [ - ":util", - "@//:libyara", - ], -) - -cc_test( - name = "test_atoms", - srcs = ["test-atoms.c"], - copts = COPTS, - linkstatic = True, - deps = [ - ":util", - "@//:libyara", - ], -) - -cc_binary( - name = "mapper", - srcs = ["mapper.c"], - copts = ["-O0"], -) - -cc_test( - name = "test_rules", - srcs = ["test-rules.c"], - copts = COPTS, - data = [ - "data/base64", - "data/baz.yar", - "data/foo.yar", - "data/include/bar.yar", - "data/xor.out", - "data/xorwide.out", - "data/xorwideandascii.out", - ], - linkstatic = True, - deps = [ - ":blob", - ":mapper", - ":util", - "@//:libyara", - ], -) - -cc_test( - name = "test_pe", - srcs = ["test-pe.c"], - copts = COPTS, - data = [ - "data/05cd06e6a202e12be22a02700ed6f1604e803ca8867277d852e8971efded0650", - "data/079a472d22290a94ebb212aa8015cdc8dd28a968c6b4d3b88acdd58ce2d3b885", - "data/079a472d22290a94ebb212aa8015cdc8dd28a968c6b4d3b88acdd58ce2d3b885.upx", - "data/3b8b90159fa9b6048cc5410c5d53f116943564e4d05b04a843f9b3d0540d0c1c", - "data/6c2abf4b80a87e63eee2996e5cea8f004d49ec0c1806080fa72e960529cba14c", - "data/ChipTune.efi", - "data/c6f9709feccf42f2d9e22057182fe185f177fb9daaa2649b4669a24f2ee7e3ba_0h_410h", - "data/ca21e1c32065352d352be6cde97f89c141d7737ea92434831f998080783d5386", - "data/e3d45a2865818756068757d7e319258fef40dad54532ee4355b86bc129f27345", - "data/mtxex.dll", - "data/mtxex_modified_rsrc_rva.dll", - "data/pe_imports", - "data/pe_mingw", - "data/tiny", - "data/tiny-idata-51ff", - "data/tiny-idata-5200", - "data/tiny-macho", - "data/tiny-overlay", - "data/weird_rich", - ], - linkstatic = True, - deps = [ - ":util", - "@//:libyara", - ], -) - -cc_test( - name = "test_elf", - srcs = ["test-elf.c"], - copts = COPTS, - data = [ - "data/elf_with_imports", - ], - linkstatic = True, - deps = [ - ":blob", - ":util", - "@//:libyara", - ], -) - -cc_test( - name = "test_api", - srcs = ["test-api.c"], - copts = COPTS, - data = [ - "data/baz.yar", - "data/x.txt", - ], - linkstatic = True, - deps = [ - ":util", - "@//:libyara", - ], -) - -cc_test( - name = "test_bitmask", - srcs = ["test-bitmask.c"], - copts = COPTS, - linkstatic = True, - deps = [ - ":util", - "@//:libyara", - ], -) - -cc_test( - name = "test_math", - srcs = ["test-math.c"], - copts = COPTS, - linkstatic = True, - deps = [ - ":util", - "@//:libyara", - ], -) - -cc_test( - name = "test_string", - srcs = ["test-string.c"], - copts = COPTS, - linkstatic = True, - deps = [ - ":util", - "@//:libyara", - ], -) - -cc_test( - name = "test_stack", - srcs = ["test-stack.c"], - copts = COPTS, - linkstatic = True, - deps = [ - ":util", - "@//:libyara", - ], -) - -# This test fails when running under ASAN -cc_test( - name = "test_exception", - srcs = ["test-exception.c"], - copts = COPTS, - linkstatic = True, - deps = [ - ":util", - "@//:libyara", - ], -) - -cc_test( - name = "test_macho", - srcs = ["test-macho.c"], - copts = COPTS, - data = [ - "data/tiny-macho", - "data/tiny-universal", - ], - linkstatic = True, - deps = [ - ":blob", - ":util", - "@//:libyara", - ], -) - -cc_test( - name = "test_dex", - srcs = ["test-dex.c"], - copts = COPTS, - linkstatic = True, - deps = [ - ":blob", - ":util", - "@//:libyara", - ], -) - -cc_test( - name = "test_dotnet", - srcs = ["test-dotnet.c"], - copts = COPTS, - data = [ - "data/0ca09bde7602769120fadc4f7a4147347a7a97271370583586c9e587fd396171", - "data/756684f4017ba7e931a26724ae61606b16b5f8cc84ed38a260a34e50c5016f59", - "data/bad_dotnet_pe", - "data/tiny", - ], - linkstatic = True, - deps = [ - ":blob", - ":util", - "@//:libyara", - ], -) - -cc_test( - name = "test_re_split", - srcs = ["test-re-split.c"], - copts = COPTS, - linkstatic = True, - deps = [ - ":util", - "@//:libyara", - ], -)