search

YARAHQ / yara-forge

Automated YARA Rule Standardization and Quality Assurance Tool
GNU General Public License v3.0
169 stars 18 forks source link

Duplicate rule name #34

Closed stanley101music closed 5 months ago

stanley101music commented 5 months ago

The rule names might be duplicated after alignment in align_yara_rule_name. For instance, there are two YARA_RULES_Upolyx_04_By_Delikon rule names from https://raw.githubusercontent.com/Yara-Rules/rules/master/packers/peid.yar because the original names are UPolyx_04_by_delikon and UPolyX_04_by_delikon. The only difference is the case of x, which is normalized to lowercase during alignment.

Neo23x0 commented 5 months ago

I don't find a duplicate rule in one of our sets. In which set did you find the duplicate rule?

Neo23x0 commented 5 months ago

Ah, https://github.com/Yara-Rules/rules isn't part of YARA Forge and that's for a reason. I reviewed around 70 repos and chose only a few of them. Why? Because I found so many crappy rules and experimental shit that I've decided to only include repositories that comply with a minimum quality standard. If you chose to add some of these crappy repos and not use the sets that I compile, then my support is limited. I may not be able to fix this duplicate rule problem soon.