Neo23x0 / Raccine

A Simple Ransomware Vaccine
The Unlicense
942 stars 123 forks source link

Wrong YARA Dir - Can't fix #61

Closed Neo23x0 closed 3 years ago

Neo23x0 commented 3 years ago

Note: Working on the new branch yara-ext-vars with changes by @JohnLaTwC

I am trying to figure out, why the rule matching process gets the wrong YARA rule directory. It uses C:\ProgramData\Raccine instead of C:\ProgramData\Raccine\yara

Screenshot 2020-10-24 101848

Can someone explain to me, why the class definition expects two variables: yara_rules_dir, raccine_program_directory https://github.com/Neo23x0/Raccine/blob/yara-ext-vars/source/RaccineLib/YaraRuleRunner.cpp#L7

Screenshot 2020-10-24 101226

and the object instantiated from that class uses different values? https://github.com/Neo23x0/Raccine/blob/yara-ext-vars/source/RaccineLib/raccine.cpp#L49 Is that the wrong location?

Screenshot 2020-10-24 101251

Neo23x0 commented 3 years ago

Ah, the wTestFilename name is misleading. I fixed it in: https://github.com/Neo23x0/Raccine/commit/0079ece73a5b5021bf87342d38945835fb523d3a

Eran-YT commented 3 years ago

You have both parameters in the class because the yara executable and the yara rules are in different directories