Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: VirusTotal/yara-python
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v4.2.0
Choose a base ref
...
head repository: VirusTotal/yara-python
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v4.3.0
Choose a head ref
  • 16 commits
  • 7 files changed
  • 4 contributors

Commits on May 18, 2022

  1. Add a "warnings" member to Rules. (#208)

    When compiling rules that have warnings currently the only way to know they have
    warnings is to specify error_on_warning=True to yara.compile(). This will throw
    an exception that you can then check the warnings member of, like this:
    
    ```
    r = 'rule a { strings: $a = "a" condition: $a } rule b { strings: $b = "b" condition: $b }'
    
    try:
        rules = yara.compile(source=r, error_on_warning=True)
    except yara.WarningError as e:
        print(e.warnings)
    ```
    
    This stops the compilation process, so if you're trying to just know if there
    are warnings but still run the rules there is no good way to do it without using
    the exception mechanism and then compiling the rules a second time (with
    error_on_warning not set).
    
    This patch adds a warnings member to the compiled Rules object, which is always
    set to a list of warning strings. If you want to error on warning you can still
    use error_on_warning=True in yara.compile() and get the normal behavior, but if
    you just want to compile and know if there are warnings you can now use this new
    member without having to compile a second time.
    
    Suggested by: Tom Lancaster
    Fixes: #207
    wxsBSD authored May 18, 2022
    Configuration menu
    Copy the full SHA
    e14f096 View commit details
    Browse the repository at this point in the history

Commits on May 20, 2022

  1. Allow metadata to contain a list of values (#201)

    The `Rules.match` function now receives an optional `allow_duplicate_metadata=True` argument, which changes the structure of `Match.meta`. By default `Match.meta` is a dictionary with metadata names and their corresponding values, if a metadata name appears duplicated in a rule, the last value will be used. For example, consider the following rule:
    
    ```yara
    rule demo {
       meta: 
         foo = "foo #1"
         foo = "foo #2"
         bar = "bar"
       condition:
          false
    }
    ```
    
    In that case `Match.meta` would be `{"foo": "foo #2", "bar": "bar"}` by default (`allow_duplicate_metadata=False`), but with `allow_duplicate_metadata=True` it would be: `{"foo": ["foo #1", "foo #2"], "bar": ["bar"]}`.
    cccs-rs authored May 20, 2022
    Configuration menu
    Copy the full SHA
    d29ca08 View commit details
    Browse the repository at this point in the history

Commits on Aug 9, 2022

  1. Update yara submodule.

    plusvic committed Aug 9, 2022
    Configuration menu
    Copy the full SHA
    919c786 View commit details
    Browse the repository at this point in the history

Commits on Oct 24, 2022

  1. chore(update): Update documentation URL (#214)

    * chore(update): Update documentation URL
    
    - Update documentation URL
    - Update copyright year
    
    * chore(update): Change copyright year
    
    * chore(update): Change copyright year
    
    * fix: README.md doesn't exist
    its0x08 authored Oct 24, 2022
    Configuration menu
    Copy the full SHA
    42ccdd3 View commit details
    Browse the repository at this point in the history

Commits on Dec 12, 2022

  1. Consolidate PRs into single branch (#219)

    * Support xor_value in returned strings.
    
    Extend the tuple that represents an instance of a match to include the xor key.
    This breaks all existing scripts that are unpacking the tuple, which I'm not
    very happy with.
    
    This also updates the submodule to use the latest master so that I can get the
    new xor key values.
    
    Also, adds a fix to get yara building here by defining BUCKETS_128 and
    CHECKSUM_1B as needed by the new tlsh stuff (discussed with @metthal).
    
    * Add two new objects to yara-python.
    
    Add a StringMatch object, which represents a matched string. It has an
    identifier member (this is the string identifier, eg: $a) and an instances
    member which contains a list of matched string instances.
    
    It also keeps track of the string flags internally but does not expose them
    directly as the string flags contain things that are internal to YARA (eg:
    STRING_FLAGS_FITS_IN_ATOM). The reason it keeps track of the string modifiers
    is so that it can be extended to allow users to take action based upon certain
    flags. For example, there is a "is_xor()" member on StringMatch which will
    return True if the string is using the xor modifier. This way users can call
    another method (discussed below) to get the plaintext string back.
    
    Add a StringMatchInstance object which represents an instance of a matched
    string. It contains the offset, matched data and the xor key used to match the
    string (this is ALWAYS set, even to 0 if the string is not an xor string).
    
    There is a "plaintext()" method on the StringMatchInstance objects which will
    return a new bytes object with the xor key applied. This allows users to do
    something like this:
    
    ```
    print(instance.plaintext() if string.is_xor() else instance.matched_data)
    ```
    
    Technically, the plaintext() method will return the matched_data if the xor_key
    is 0 so they don't need to do the conditional but this allows them a nice way to
    know if the xor_key is worth recording along with the plaintext.
    
    I decided not to implement richcompare for these new objects as it isn't
    entirely clear what I would want to do the comparison on.
    
    * Add "matched_length" member.
    
    Add a "matched_length" member to match instances. This is useful when the
    "matched_data" member is a subset of the actually matched data.
    
    Add a test for this that sets the max_match_data config to 2 and then checks to
    make sure the "matched_length" and "matched_data" members are correct.
    
    * Add modules list to yara object.
    
    Add support for getting the list of available modules. It is available just by
    accessing the yara.modules attribute, which contains a list of available
    modules.
    
    >>> print('\n'.join(yara.modules))
    tests
    pe
    elf
    math
    time
    console
    >>>
    
    Note: This commit also brings in the necessary defines to build the authenticode
    parser, which is also done in the xor_value branch. Also, this commit updates
    the yara submodule which will likely overwrite the changes done in the xor_value
    so I recommend updating the submodule after both are merged.
    
    * Update yara to 65feab41d4cbf4a75338561d8506fc1fa9fa6ba6.
    
    * Fix test using \t in a regex.
    
    * Fix build on Windows in appveyor.
    
    * Actually fix appveyor builds on windows?
    wxsBSD authored Dec 12, 2022
    Configuration menu
    Copy the full SHA
    65378d4 View commit details
    Browse the repository at this point in the history

Commits on Dec 19, 2022

  1. Update YARA submodule.

    plusvic committed Dec 19, 2022
    Configuration menu
    Copy the full SHA
    875cf34 View commit details
    Browse the repository at this point in the history
  2. Fix wrong return types.

    plusvic committed Dec 19, 2022
    Configuration menu
    Copy the full SHA
    a4b2ae2 View commit details
    Browse the repository at this point in the history
  3. Fix build in Windows.

    plusvic authored Dec 19, 2022
    Configuration menu
    Copy the full SHA
    a74cf3f View commit details
    Browse the repository at this point in the history

Commits on Dec 30, 2022

  1. Upgrade YARA submodule.

    plusvic committed Dec 30, 2022
    Configuration menu
    Copy the full SHA
    bb0211e View commit details
    Browse the repository at this point in the history
  2. Update Python versions in appveyor.yml.

    * Remove Python 3.5 and 3.6 which are already unsupported.
    * Add Python 3.11.
    plusvic committed Dec 30, 2022
    Configuration menu
    Copy the full SHA
    cea9bc3 View commit details
    Browse the repository at this point in the history
  3. Don't build with Python 3.11.

    For some reason the generation of the .msi installer is failing with Python 3.11.  It fails with error: error: invalid format 'msi'. The documentation the argument `--format=msi` should be correct. 
    
    https://docs.python.org/3/distutils/builtdist.html
    plusvic committed Dec 30, 2022
    Configuration menu
    Copy the full SHA
    3a6a633 View commit details
    Browse the repository at this point in the history

Commits on Jan 31, 2023

  1. Always enable the dotnet module. (#222)

    When building prior to this commit the dotnet module would be disabled unless
    you explicitly asked for it. This is the opposite of what the default is in
    libyara. Fix it by always building the dotnet module.
    
    Tested with:
    
    ```
    wxs@mbp yara-python % PYTHONPATH=build/lib.macosx-10.9-universal2-3.9 python3 -c 'import yara; print(yara.modules)'
    ['tests', 'pe', 'elf', 'math', 'time', 'console', 'string', 'dotnet', 'hash']
    wxs@mbp yara-python %
    ```
    
    Without this change the dotnet module would not be in the list.
    wxsBSD authored Jan 31, 2023
    Configuration menu
    Copy the full SHA
    d61262b View commit details
    Browse the repository at this point in the history

Commits on Feb 8, 2023

  1. Remove --enable-dotnet argument while building yara-python in Appve…

    …yor.
    
    This argument has been removed in #222
    plusvic committed Feb 8, 2023
    Configuration menu
    Copy the full SHA
    af50c40 View commit details
    Browse the repository at this point in the history
  2. Upgrade YARA submodule

    plusvic committed Feb 8, 2023
    Configuration menu
    Copy the full SHA
    4863e25 View commit details
    Browse the repository at this point in the history

Commits on Mar 22, 2023

  1. Update YARA submodule.

    plusvic committed Mar 22, 2023
    Configuration menu
    Copy the full SHA
    e1175e2 View commit details
    Browse the repository at this point in the history
  2. Bump version number to 4.3.0

    plusvic committed Mar 22, 2023
    Configuration menu
    Copy the full SHA
    39ca6d3 View commit details
    Browse the repository at this point in the history
Loading