Invalid field name "imphash" on 4.1.0

Open
#179 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
python
Domain
security

Research direction

Start by running reproduce.py with yara-python 4.1.0 and inspect the yara.compile call that imports pe and uses pe.imphash(). Trace how the Python package exposes the YARA compiler and verify completion by making the supplied rule compile without the invalid-field error.

Written by the indexing model from the issue text.

Description

The latest version of yara-python is unable to compile rules with pe.imphash():

# reproduce.py

import yara

print(yara.YARA_VERSION)

rule = yara.compile(source='import "pe" rule my_imphash {condition: pe.imphash()=="eecc824da5b175f530705611127a6b41"}')
$ python3 reproduce.py
4.1.0
Traceback (most recent call last):
  File "reproduce.py", line 5, in <module>
    rule = yara.compile(source='import "pe" rule my_imphash {condition: pe.imphash()=="eecc824da5b175f530705611127a6b41"}')
yara.SyntaxError: line 1: invalid field name "imphash"

I am running this on Ubuntu 20.04.2 on Windows Subsystem for Linux:

$ cat /etc/os-release
NAME="Ubuntu"
VERSION="20.04.2 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.2 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal

I installed yara-python with:

$ python3 -m pip install --global-option="build" --global-option="--enable-cuckoo" --global-option="--enable-magic" --no-cache-dir yara-python
/usr/lib/python3/dist-packages/pip/_internal/commands/install.py:255: UserWarning: Disabling all use of wheels due to the use of --build-option / --global-option / --install-option.
  cmdoptions.check_install_build_global(options)
Collecting yara-python
  Downloading yara-python-4.1.0.tar.gz (425 kB)
     |████████████████████████████████| 425 kB 10.6 MB/s
Skipping wheel build for yara-python, due to binaries being disabled for it.
Installing collected packages: yara-python
    Running setup.py install for yara-python ... done
Successfully installed yara-python-4.1.0

Here's the package info:

$ python3 -m pip show yara-python
Name: yara-python
Version: 4.1.0
Summary: Python interface for YARA
Home-page: https://github.com/VirusTotal/yara-python
Author: Victor M. Alvarez
Author-email: plusvic@gmail.com, vmalvarez@virustotal.com
License: Apache 2.0
Location: /home/michael/.local/lib/python3.8/site-packages
Requires:
Required-by:

To verify the package:

$ tar cvf - /home/michael/.local/lib/python3.8/site-packages | sha1sum
tar: Removing leading `/' from member names
/home/michael/.local/lib/python3.8/site-packages/
/home/michael/.local/lib/python3.8/site-packages/yara.cpython-38-x86_64-linux-gnu.so
/home/michael/.local/lib/python3.8/site-packages/yara_python-4.1.0.egg-info/
/home/michael/.local/lib/python3.8/site-packages/yara_python-4.1.0.egg-info/dependency_links.txt
/home/michael/.local/lib/python3.8/site-packages/yara_python-4.1.0.egg-info/installed-files.txt
/home/michael/.local/lib/python3.8/site-packages/yara_python-4.1.0.egg-info/not-zip-safe
/home/michael/.local/lib/python3.8/site-packages/yara_python-4.1.0.egg-info/PKG-INFO
/home/michael/.local/lib/python3.8/site-packages/yara_python-4.1.0.egg-info/SOURCES.txt
/home/michael/.local/lib/python3.8/site-packages/yara_python-4.1.0.egg-info/top_level.txt
e4684e352ae0ae660ed5010b38bd73d989317af1  -
Dominant language
C
Stars
754
Forks
190
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from VirusTotal/yara-python

All issues in VirusTotal/yara-python

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.