Feature: Pass external variables into YARA matching

[Eran-YT]

I opened a PR that fixes the conflicts, it compile and the tests pass, but there are no tests for the new features, so I don't know if they work

[Neo23x0]

It builds but fails to run.

Faulting application name: Raccine.exe, version: 0.0.0.0, time stamp: 0x5f95c384
Faulting module name: Raccine.exe, version: 0.0.0.0, time stamp: 0x5f95c384
Exception code: 0xc0000409
Fault offset: 0x0000000000024e4d
Faulting process id: 0x1a08
Faulting application start time: 0x01d6aafc89879cec
Faulting application path: C:\Program Files\Raccine\Raccine.exe
Faulting module path: C:\Program Files\Raccine\Raccine.exe
Report Id: 9e9e573c-3bb7-4d40-8404-62c346d4238a
Faulting package full name: 
Faulting package-relative application ID: 

[Eran-YT]

I don't know why that is, works fine on my machine. What command line did you use?

[Neo23x0]

Any command line that triggers Raccine causes this crash on my machine.

Exception code: 0xc0000409 means STATUS_STACK_BUFFER_OVERRUN

[Neo23x0]

I'll start debugging ... I already found out that it happens when the YARA rules are read.

[Neo23x0]

It seems to be a problem with the directory_iterator that I haven't seen before. It tried it with several existing paths and even rebooted the system once in between.

[Neo23x0]

It works when I set it manually to a wstring of L"C:\\ProgramData\\Raccine\\yara"

And it doesn't appear when I use .c_str()

According to the documentation, the current version should be okay. https://docs.w3cub.com/cpp/filesystem/directory_iterator/directory_iterator/

I don't understand why that happens.

[Eran-YT]

Try to see if you have a null character at the end of the yara_rules_dir variable, that might cause this

[Neo23x0]

I've edited the value in Registry multiple times while testing, removed it with an uninstall, added it again using:

REG.EXE ADD HKLM\Software\Raccine /v RulesDir /t REG_SZ /d %ProgramData%\Raccine\yara /F

Maybe the function that reads Registry string values has an error.

[Eran-YT]

From a quick look, it seems raccineconfig::read_string_from_registry has a bug, I’ll see if I can fix it

[Eran-YT]

@Neo23x0 try to see if #71 solves this crash