Closed Ana06 closed 2 years ago
yara-python
doesn't offer a way for compiling multiple files within the same namespace, you can compile multiple files but each on a different namespace.
I think the argument validation for the compile
function should be improved, your example should have failed with some error.
I have the following two rules, in different files, where the second reference the first one :
and the file
text.txt
:With yara (64 windows, version 4.1.3) I am able to load both rules and match them:
In yara-python (also version 4.1.3), the documentation doesn't mention explicitly how to compile more than one rule, but I was expecting the following to work:
As you see, only the first rule is matched. In fact, it seems the second rule is completely ignored as
compile('rule1.yara', 'rule2.yara')
still works ifrule2.yara
has syntax errors.This is a confusing behavior. Is this a bug? How can I compile more than one rule at once where one reference another one (same namespace)?