TypeError: 'yara.StringMatch' object is not subscriptable

[4hem]

Failed while executing plugin_t.run(): Traceback (most recent call last): File "D:/tools/IDA_Pro_7.7/plugins/findcrypt3.py", line 224, in run self.search() File "D:/tools/IDA_Pro_7.7/plugins/findcrypt3.py", line 180, in search values = self.yarasearch(memory, offsets, rules) File "D:/tools/IDA_Pro_7.7/plugins/findcrypt3.py", line 197, in yarasearch self.toVirtualAddress(string[0], offsets), TypeError: 'yara.StringMatch' object is not subscriptable

[serv0id]

https://github.com/polymorf/findcrypt-yara/pull/45

[muha2xmad]

The same problem here with yara-python 4.3.1

[muha2xmad]

I solved this problem by installing yara-python 4.2

[1198287349]

The yarsearch function needs to be modified as follows：

def yarasearch(self, memory, offsets, rules): print(">>> start yara search") values = list() matches = rules.match(data=memory) for match in matches: for stringR in match.strings: name = match.rule for string in stringR.instances: if name.endswith("API"): try: name = name + "" + idc.GetString(self.toVirtualAddress(string.offset, offsets)) except: pass value = [ self.toVirtualAddress(string.offset, offsets), match.namespace, name + "_" + hex(self.toVirtualAddress(string.offset, offsets)).lstrip("0x").rstrip("L").upper(), stringR.identifier, repr(string.matched_data) ] idaapi.set_name(value[0], name

• "_"
• hex(self.toVirtualAddress(string.offset, offsets)).lstrip("0x").rstrip("L").upper() , 0) values.append(value) print("<<< end yara search") return values