VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-12 02:10:00 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,058 Commits 5 Branches 56 Tags
fc2191fdde407e3d55e006eb96cab75bee1ca5be
Commit Graph
2058 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ԝеѕ fc2191fdde Update CodeMirror mode (#986) 2018-11-20 17:34:12 +01:00
Victor M. Alvarez d7b9d5cbe5 Add YARA language mode for CodeMirror https://codemirror.net/ 2018-11-20 08:44:51 +01:00
clem1 aa182b4f92 yara: add a simple fuzzer for dotnet module. (#980) 2018-11-07 11:53:42 +01:00
Dani Koretsky 6bdf2cac4a add Cybereason to list of vendors (#977) 
We are implementing it in multiple systems of ours, please let me know if there's anything else I need to do in order to add us to the list of vendors who use this library
 2018-11-06 21:10:40 +01:00
packetzero a05e9bf150 Add StaticRelease|x64 config with NDEBUG (#975) 2018-11-06 21:09:46 +01:00
Dani Koretsky 6221701c57 remove yr_finalize_thread from docs (#972) 
update documentation to not require any threads to call yr_finalize_thread anymore
 2018-10-25 22:05:44 +02:00
Dani Koretsky 047579856b _MSC_VER < 1900 doesn't always work (#973) 
compiling on MSVC 2013 (toolset v120_xp) with windows 10 sdk and CRTs that are newer causes snprintf to already be defined (from stdio.h for example)
Adding a simple check to see if it is not already defined before defining.

Might be worth adding checks for all other macros like this to save compilation errors on other unexpected configurations.
 2018-10-25 22:03:47 +02:00
Benjamin Gathmann 06b9e19479 correct sudo command (#949) 
This way it works and users can just copy paste and run it
 2018-10-23 16:48:16 +02:00
Sulabh Jain c8b805dead Add Dtex Systems to who's using YARA (#947) 2018-10-23 16:47:10 +02:00
marmeladema 9fb5c9bf8d Fix int64_t printed as uint64_t in yr_object_print_data (#966) 2018-10-23 16:42:38 +02:00
Marek Milkovič 3b4d5133a3 Fixed occasional 'internal error: 31' when running multiple instances of YARA at the (#945) 
same time
 2018-09-03 18:35:53 +02:00
Victor M. Alvarez 8cdfef1081 Merge branch 'master' of https://github.com/VirusTotal/yara 2018-08-29 16:30:52 +02:00
Victor M. Alvarez 97ddc18cb2 Fix wrong statement in documentation about the write function in YR_STREAM. 2018-08-29 16:29:55 +02:00
Hilko Bengen 1b10029e8e is_integer(): Reject empty strings (#942) 
As reported by Florian Roth: Using -d:str= to compile

    rule t { condition: str = "xyz" }

fails with

    error: type mismatch
 2018-08-29 14:08:38 +02:00
Victor M. Alvarez 1174efe1d2 Fix race condition. 2018-08-24 15:52:11 +02:00
Victor M. Alvarez d0231863db Increase ARENA_FILE_VERSION. 2018-08-23 13:56:09 +02:00
Victor M. Alvarez e748df2139 Add num_atoms field to YR_RULE structure. 2018-08-23 13:55:08 +02:00
Victor M. Alvarez 596b47f5a2 Remove unused RE opcode. 2018-08-21 10:20:32 +02:00
Victor M. Alvarez 72fd000469 Fix contention while incrementing profiling counters. 
In 3cceccd8b6 the increment of profiling counters was changed to an atomic operation. This fixed race-conditions but introduced a noticeable contention while using the same YR_RULES structure with multiple threads. This commit fixes this problem by using one counter per thread, which are aggregated later, outside the critical path.
 2018-08-20 14:57:45 +02:00
Victor M. Alvarez ee92a3e2d8 Update description of yr_bitmask_find_non_colliding_offset function. 2018-08-20 12:18:07 +02:00
Victor M. Alvarez 7d456c345d Fix bug while incrementing profiling counters. 
In 3cceccd8b6 synchronization functions were added for guaranteeing that increments where atomic, but the wrong rule pointer was used.
 2018-08-18 13:00:58 +02:00
Victor M. Alvarez 309894830a Reduce warning threshold for removing warnings caused by certain strings containing spaces. v3.8.1 2018-08-16 12:25:49 +02:00
Victor M. Alvarez f14c5cb5b9 Minor style fixes. 2018-08-15 09:42:17 +02:00
Hilko Bengen 192aa992c1 Use __attribute__((format(...))) for GCC, fix warnings (#932) 
* Use YR_PRINTF_LIKE for yr_object_* functions

* Eliminate format-string-related warnings in pe, macho, dex modules
 2018-08-15 09:28:20 +02:00
Victor M. Alvarez 537fd58d18 Fix warning threshold as it was causing too many warnings after 8c11db371a. 
Also fix the test cases that were supposed to catch this regression and didn't.
 2018-08-15 09:24:17 +02:00
Victor M. Alvarez 2d8da2d5b8 Set version number to 3.8.1 2018-08-14 12:26:31 +02:00
Victor M. Alvarez d1986a664a Set version number to 3.8.1 2018-08-14 12:21:29 +02:00
Victor M. Alvarez a4ab2c034d Allow yr_hash to receive zero-length strings. 
Fixes https://github.com/VirusTotal/yara-python/issues/93.
 2018-08-14 11:57:31 +02:00
Victor M. Alvarez 8c11db371a Fix issue causing that shorter atoms are considered of higher quality than longer ones. 
Because of the way in which atom quality was being calculated atom {00} was considered better than atom {00 00}.
 2018-08-10 13:38:38 +02:00
Wesley Shields 84b3dadbd1 Fix argument size when setting booleans. (#927) 2018-08-08 18:13:03 +02:00
Hilko Bengen 28839a6eed Fix macho module on 32bit architectures (#929) 
printf(3)-style expressions such as "segments[%i].sections[%i].segname"
expect int-size values. With the first value being defined as an
uint64_t, this holds true on 64bit architectures only.
 2018-08-08 18:09:04 +02:00
Hilko Bengen 83ab75a82c Make tests find external files if run from separate build directory (#930) 2018-08-08 18:07:51 +02:00
Hilko Bengen 045ba82fc9 Fix dex module on big-endian architectures (#931) 2018-08-08 18:06:36 +02:00
Victor M. Alvarez d545b69ca3 Closes #928. 2018-08-08 15:18:42 +02:00
Victor M. Alvarez 2c511d98b4 Add literal string for end-of-file token. 
Now errors are like "error: syntax error, unexpected end of file", instead of "error: syntax error, unexpected $end".
 2018-08-08 13:17:52 +02:00
Victor M. Alvarez a7bdae6dcc Add literal strings to tokens for more readable error messages. 2018-08-08 13:09:45 +02:00
Victor M. Alvarez 3b3eddc4e7 Add deprecation notice in the documentation for yr_finalize_thread. 2018-08-06 19:35:25 +02:00
Hilko Bengen 8d78e75ded Keep ABI compatibility by keeping deprecated functions visible (#926) 2018-08-06 19:28:47 +02:00
Victor M. Alvarez 4d167ecf96 Set version number to 3.8.0 v3.8.0 2018-08-06 15:28:12 +02:00
Victor M. Alvarez 7bfe1519b4 Fix type in macro definition for in Visual Studio project. 2018-08-06 13:07:26 +02:00
Victor M. Alvarez 3cceccd8b6 Fix race conditions when using the same YR_RULES struct from differen… (#925) 
* Fix race conditions when using the same YR_RULES struct from different threads with PROFILING_ENABLED.

* Make time_cost signed as InterlockedAdd64 expects a signed integer.

Closes #918.
 2018-08-06 02:13:38 -07:00
Victor M. Alvarez 39602514e2 Use YR_BUILDING_DLL and YR_IMPORTING_DLL for controlling the semantics of YR_API (#924) 
For compiling YARA in Windows as a DLL you must define YR_BUILDING_DLL. For using it that DLL in your project you must define YR_IMPORTING_DLL. This allows to use the same header files in both cases. If YR_BUILDING_DLL is defined, YR_API translates to __declspec(dllexport), if YR_IMPORTING_DLL is defined YR_API translates to __declspec(dllimport).
 2018-08-02 11:57:53 +02:00
Victor M. Alvarez 803d42a84c Determine equality of floating point values as abs(A-B) < epsilon instead of A == B. 
Precise equality can lead to wrong results due to small differences in values cause by rounding. Closes issue #561.
 2018-08-02 09:39:22 +02:00
Victor M. Alvarez f9a52f0ed4 Remove AC_PROG_LIBTOOL as it is deprecated and LT_INIT is enough. 
Closes #491.
 2018-08-02 08:40:02 +02:00
Victor M. Alvarez a16dcba988 Allow using "-" in command-line to read files rules from stdin. 
Closes #657.
 2018-08-02 00:42:36 +02:00
Victor M. Alvarez 26d9e95693 Update man page. 2018-08-02 00:41:17 +02:00
Victor M. Alvarez 8da7fe4a27 Sort command-line options alphabetically. 2018-08-02 00:41:07 +02:00
Victor M. Alvarez c90cb174f3 Sort command-line options alphabetically. 2018-08-02 00:30:08 +02:00
Victor M. Alvarez 598a564133 Minor style fixes in documentation. 2018-08-01 23:47:20 +02:00
Ԝеѕ 47699e7b4f Describe pe characteristics (#923) 2018-08-01 23:32:13 +02:00