Closed Peppaisdumb closed 5 months ago
What you you mean with "I get a unknown callback msg"? Is your callback function being called? Which messages codes are seeing in the callback function?
fixed it:) 0
The definition of YR_CALLBACK_FUNC is as follows:
typedef int (*YR_CALLBACK_FUNC)(
YR_SCAN_CONTEXT* context,
int message,
void* message_data,
void* user_data);
And my callback function has the following signature:
int callback(int message, void* message_data, void* user_data);
Was missing an arg, works fine now. Appreciate the help:)
So, I'm using libyara in C++ and trying to create a scanner that scans a file against given yara rules and return if it finds any matches. Here's the flow of the project -
Here's my yara rules source file with a .yar extension -
rule AlwaysTrue { condition: true }
Below, I've attached my compiler.cpp and scanner.cpp files (uploaded here in txt format cuz cpp isn't allowed) scan.txt compile.txt
And now, according to the rules file, I should always get a match as the rule is always true, but I get a unknown callback msg. as mentioned in my scanner file
Though, when I try to scan my file with yara cli using the same .yar rules file, it works and gives me a match.
Now I don't know where I went wrong but would appreciate any help:) (been stuck with this for 2 days now:/)