Comments (7)
From [email protected] on May 11, 2012 05:25:34
Even if this feature is implemented it won't apply to version 1.6 and lower. I mean, in version 1.7 you will be able to ignore new syntax included in version 1.8, but version 1.6 and lower will fail anyway.
Could you explain a little more your real-life situation where this feature is needed? Why not keeping your YARA version up to date?
from yara.
From [email protected] on May 11, 2012 07:09:37
Sure, I'd be happy to provide more detail:
Assume you have 1,000's of "systems" all with YARA installed. Do you really think its realistic that you should have to "upgrade" those instances of YARA, simultaneously? If you have a directory containing your "master YARA rule list" that is being replicated out to each of these systems, before you upgrade any of those rules to leverage new features, you have to make sure that all versions of YARA across all 1000 systems are updated, accordingly. Currently, to get around this, you'd have to externally maintain different "versions" of the "master list" for each version of YARA, which makes overall rule management more painful than it needs to be.
Yes, if v1.7 started implementing this feature, you would still have to deal with this painful setup at least until all your systems are upgraded to v1.7. But, once that happens, when v1.8 and later is released, the process becomes much more manageable.
Lastly, if you're accepting YARA rules for a third-party, having an option to require min_version on each rule makes it easier to perform initial rule validation back to that third-party. For example, if you're running YARA v1.4 and the third-party uploads v1.6 YARA rules, we can have YARA output an explicit "unsupported version" error message, rather than vague syntax errors, which we then have to decipher and translate as "unsupported version", accordingly.
Does this make sense?
from yara.
From [email protected] on May 11, 2012 07:13:02
To clarify further, if YARA v1.7 implemented the "min_version" meta tag, you could then provide a command-line options like:
--enforce_version
If (--enforce_version) were present, YARA would explicitly generate errors if it encountered any rule with min_version higher than its current version.
If (--enforce_version) were NOT present, then YARA would silently ignore any rules where min_version is higher than its current version.
from yara.
From [email protected] on May 11, 2012 16:05:50
Ok, I see your point. But I think, I would prefer some kind of preprocesor directives in the style of the C language. For example:
#if yara_version >= 1.7
some rules here using new features available in 1.7
#endif
That would be more flexible. What do you think?
from yara.
From [email protected] on May 11, 2012 17:08:49
Sure, that makes complete sense. Thanks for your time!
from yara.
From [email protected] on August 15, 2012 09:11:59
This will be solved with a C-style preprocessor with conditionals. See issue 61 .
from yara.
From [email protected] on August 15, 2012 09:12:16
Status: WontFix
from yara.
Related Issues (20)
- Using YARA scanning process in a container led to OOM due to the generation of a large amount of cache. HOT 1
- Windows Defender detects YARA as Malware!! HOT 1
- Assert thrown for PE module in debug
- False negative with certain hex patterns
- Problem while using scanner with libyara in C++ HOT 2
- Add libyara.lib in the windows builds of the ci
- ERROR_TOO_MANY_SCAN_THREADS HOT 1
- Alignment in 32-bits. Again
- Add Support for Scanning Windows 64-bit process from 32-bit Processes in YARA HOT 3
- Ruby yara-ffi and virustotal yara release 4.5.0 HOT 1
- Build fails for Ubuntu 22.04 HOT 5
- NULL pointer dereference in libyara/re.c
- Test failure on OpenBSD - tests/test-pe.c:390: rule does not match contents HOT 4
- Crash with deeply nested directory hierarchies HOT 5
- Mingw fail to find jansson HOT 4
- add lookaround forward/backward to regular expression. HOT 1
- Excluding the feature of scanning folders HOT 1
- Fast Scan mode not working as intended when using `x of them` conditions HOT 2
- pe.signatures[n].issuer not working at the lasts version HOT 6
- Link of Windows YARA install is not working. HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from yara.