search

VirusTotal / yara-python

The Python interface for YARA
http://virustotal.github.io/yara/
Apache License 2.0
637 stars 178 forks source link

bug in Yara-python 4.3.0 - could not map file "<data>" into memory #232

Closed Shunitc closed 1 year ago

Shunitc commented 1 year ago

Hey All! After quite a while of searching for a solution for this, I've downgraded to yara-python 4.2.3, where this problem does not appear, which lead me to believe it is an issue with the new version..

Explaining about the bug: When scanning for a large file, containing several dll files (and other files too), the code crashes with the error: "yara.Error: could not map file "" into memory" I'm using Windows, with a python version of 3.10.10 and installed yara-python 4.3.0 using "[yara-python-4.3.0.win-amd64-py3.10.msi]" in the release page. I've tried any other solution I can think of, including only using 1-2 rules, 1 single file, checked the dll sizes etc..., none of which solved the problem. I traced it to occur when I call "rule.match". As mentioned, when I went back to 4.2.3, the problem did not occur once more, even when the rest of the conditions (same code, file and rules) remained the same.

Shunitc commented 1 year ago

Update - I was able to stop it from crashing when I deleted every yara rule that was using the dotnet module.

tlansec commented 1 year ago

This was fixed here:

https://github.com/VirusTotal/yara/pull/1902

plusvic commented 1 year ago

The fix has been released in version 4.3.1.