VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
8.08k stars 1.43k forks source link

.yar is correct but .yc error: non-ascii character #1985

Closed gaohang closed 10 months ago

gaohang commented 10 months ago

[Problem] test.yc(1): error: syntax error test.yc(1): error: non-ascii character

[Description] I write any yar rule file test.yar. e.g. rule MetadataExample { meta: my_identifier_1 = "Some string data"

    strings:
        $my_text_string = "text here"

    condition:
        $my_text_string 
}

then compile the test.yar into test.yc without no error or warning. Finally, I tested the test.yc and test.yar rule by scanning some target files in cmd line. The results always: 1) when I use test.yc: yara test.yc target_file, I got error msg [test.yc(1): error: syntax error test.yc(1): error: non-ascii character] 2) when I use test.yar, it succeed

why?

[yara version 4.2.3, ubuntu 22.04]