Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Can't open include file when compiling multiple rules

Abierto
  • ¿Algo no está bien?
#112 3 comentarios 1 reacción 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
42/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Estancado
Stack tecnológico
c, python
Área
tooling

Línea de trabajo

Reproduce the failure with yara.compile('./malware_index.yar') from the Yara-Rules rules directory, then compare it with yarac malware_index.yar malware_index. Trace how the Python compile entry point handles included files such as malware/MALW_AZORULT.yar and TOOLKIT_exe2hex_payload.yar. Done means Python compilation succeeds for the demonstrated rulesets without the erroneous include-file failure.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

  1. Checkout https://github.com/Yara-Rules/rules (this also happens with other rulesets, but this is convenient to demonstrate the issue)
  2. from the rules directory, run 'rules = yara.compile('./malware_index.yar')

Yara raises a syntax

  File "yara-python-test.py", line 3, in <module>
    rules = yara.compile('./malware_index.yar')
yara.SyntaxError: ././malware/MALW_AZORULT.yar(377): can't open include file: ./malware/TOOLKIT_exe2hex_payload.yar

The rule MALW_AZORULT.yar doesn't refer to the exe2hex payload rule:

/*
    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/

import "cuckoo"
rule Windows_Malware : Azorult_V2
    {
            meta:
                    author = "Xylitol [email protected]"
                    date = "2017-09-30"
                    description = "Match first two bytes, strings, and parts of routines present in Azorult"
                    reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=4819&p=30867"
                    // May only the challenge guide you
            strings:
                    $mz = {4D 5A}
                    $string1 = "ST234LMUV56CklAopq78Brstuvwxyz01NOPQRmGHIJKWXYZabcdefgDEFhijn9+/" wide ascii // Azorult custom base64-like alphabet
                    $string2 = "SYSInfo.txt"
                    $string3 = "CookieList.txt"
                    $string4 = "Passwords.txt"
                    $constant1 = {85 C0 74 40 85 D2 74 31 53 56 57 89 C6 89 D7 8B 4F FC 57} // Azorult grabs .txt and .dat files from Desktop
                    $constant2 = {68 ?? ?? ?? ?? FF 75 FC 68 ?? ?? ?? ?? 8D 45 F8 BA 03 00} // Portion of code from Azorult self-delete function
            condition:
                    ($mz at 0 and all of ($string*) and ($constant1 or $constant2) or cuckoo.sync.mutex(/Ad48qw4d6wq84d56as|Adkhvhhydhasdasashbc/))
    }

running the same command with yara itself works fine (albeit with warnings):

yarac malware_index.yar malware_index
./malware/APT_DPRK_ROKRAT.yar(43): warning: $b2 in rule ROKRAT_loader is slowing down scanning
./malware/MALW_IcedID.yar(18): warning: $magic1 in rule IceID_Bank_trojan is slowing down scanning
./malware/Operation_Blockbuster/sharedcode.yara(155): warning: $a in rule DynamicAPILoading is slowing down scanning
./malware/Operation_Blockbuster/sharedcode.yara(181): warning: $a in rule DNSCalcStyleEncodeAndDecode is slowing down scanning
./malware/RAT_DarkComet.yar(123): warning: $data contains .* or .+, consider using .{,N} or .{1,N} with a reasonable value for N

On a different machine, I get the same error but with different files. If I remove the MALW_AZORULT.yar file I get the same error with a different rule each time. This error also happens with https://github.com/Neo23x0/signature-base

Lenguaje dominante
C
Estrellas
754
Forks
191
Sin PR fusionados en 30 d

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de VirusTotal/yara-python

Todos los issues de VirusTotal/yara-python

Issues similares

Más issues de C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.