yara 1.5 for windows problem about yara HOT 3 CLOSED

From [email protected] on May 31, 2012 18:43:47

Out of curiosity, I decided to test this just now with Yara v1.6
(Disclaimer: I have nothing to do with Yara, I'm just a regular user.)

I don't really understand what this bug report is saying, but here are my observations about " at ":

2 of ($foo*) will...

... always be false if you only have one "$foo1" defined in the strings section.

... be true if you repeat your string twice, even if your input only has a single occurrence. So,
$foo1="foo"
$foo2="foo"
2 of ($foo*)
will always be true if your input file contains a single "foo" string. In general, I don't think anyone is ever going to be writing rules like this.

... work correctly if you have three strings defined, and any two of them appear at least once, for each string. So,
$foo1="foo"
$foo2="bar"
$foo3="buz"
2 of ($foo*)
will match "foobar", but not match "foofoo" or "barbar" Is this the issue?

from yara.

From [email protected] on August 15, 2012 09:02:30

During a brief period of time a buggy version 1.5 having this problem was available to download. The issue was solved short after that this shouldn't be a problem with more recent versions.

Status: Done

from yara.

From [email protected] on August 15, 2012 09:02:32

During a brief period of time a buggy version 1.5 having this problem was available to download. The issue was solved short after that this shouldn't be a problem with more recent versions.

from yara.