Closed N0fix closed 3 years ago
Thanks for the detailed repro. I'll investigate this tonight.
Further investigation might indicate that the problem is located here. The characteristics
field would not be retrieved (returning YR_UNDEFINED), thus leading to the flag FILE_IS_DLL not to be read.
I think you're close but probably not for the right reasons. I can replicate this problem. Here's what I've discovered so far:
message
value passed to yara_callback
in yara-python.c the values passed in when it works are: import module (4), module imported (5), rule matched (1), scan finished (3). If you check when it doesn't work the values are: import module (4), module imported (5), rule not matched (2), scan finished (3). Given the logic of rule matching is done in libyara this indicates yara-python.c is not a problem.is_undefined()
check pointed out is returning true, despite the "characteristics" field always being set properly. Given that I can not trigger this when building libyara normally I suspect this is in the way the compiler is invoked when using setup.py
.I'm tired tonight, I'll keep digging tomorrow night.
I found out that if you change the order of include statements in pe.c
it works fine. Including yara/modules.h
before yara/pe.h
is enough to fix it, but didn't find the root cause yet.
@metthal mentioned that this might be related to https://github.com/VirusTotal/yara-python/pull/159/ and he is right. I checked out 4fa2fe8
and then manually applied his patch to it and it's working as expected.
Closing this issue since #159 has been accepted and merged into master. 4.0.5 seems to be working perfectly well. Thanks for your researches to find the source of this bug.
Hello,
I have noticed that
is_dll()
function inpe
module from yara project is not working properly on yara-python from version 4.0.0 up to current one (4.0.4).It seems like for the same version of yara-python and yara (the standalone executable), different results occur when using this specific function.
Reproducible example
I got the kernel32.dll file used for the example from here. Its SHA256 shasum is :
0b2e367d671073efd70641a198c340b12b1bd813263050ae16b9c48b414775e0
.Further notes
I have been checking version number inside the library used by yara-python after installation (
strings -a /home/myuser/myvenv/lib/python3.8/site-packages/yara.cpython-38-x86_64-linux-gnu.so | grep -E '4\.[0-9]'
) and the version of the library used by yara, and they match (4.0.2).This behavior has been noticed on other computers too, and is not distribution related from what I could test. I tried to install yara in various ways (source code & distribution's package installer), and both confirm the behavior stated above.
After some testing with yara-python different versions packaged to pip, I noticed that this behavior start happening after version 4.0.0 included.
Cheers, Nofix