Skip to content

Releases: VirusTotal/yara-x

v1.9.0

03 Nov 12:10
01ef5e2

Choose a tag to compare

  • Add function for scanning files by path to the C and Go APIs (32bac10).
  • Add version number to the Rust API (bdb53e8, #469).
  • Add osabi field to elf module (afa0960).
  • Avoid verifying patterns when the file size is not in the range specified in the rule condition (#473).
  • Avoid emitting code that invokes search_for_patterns if not necessary (#487).
  • Implement DFS iterator for expressions in AST (#488).
  • BUGFIX: Check if AddressOfFunctions is zero while parsing PE files (#482).

Contributors: @vojone

v1.8.1

07 Oct 15:09
c2a09cc

Choose a tag to compare

  • BUGFIX: don't mangle the C API function yrx_finalize and include it in the header files (#467).
  • BUGFIX: fix some issues and edge cases in block scanning (d7873db).

Contributors: @metthal

v1.8.0

06 Oct 10:19
dcde4cb

Choose a tag to compare

  • Implement block scanning API for Rust and C (#459, 185c2ee).
  • Implement Golang and C APIs for setting global variables of type array and structure (#449).
  • Add iterator for Rules object in Python (#463).
  • BUGFIX: Inconsistency with legacy YARA in PE certificate subjects (445e7e4).

Contributors: @nmbarel

v1.7.1

19 Sep 10:58
340f573

Choose a tag to compare

  • BUGFIX: fix compilation in 32-bits platforms (#453).

v1.7.0

17 Sep 10:51
a01b1be

Choose a tag to compare

  • New warning suggesting the use of none of them instead of 0 of them.
  • Added option --max-matches-per-pattern to the CLI and the max_matches_per_pattern method to the Python API (#437).
  • New yrx_finalize function to the C API that allows dynamically unloading the YARA-X library (#445).
  • Add yrx_compiler_add_include_dir function to the C API (#447).
  • Replace the Formatter::ident_spaces method with Formatter::indentation (b8a1808).
  • BUGFIX: Indentation issues in code formatter (6bfe2e2).
  • BUGFIX: Inconsistencies in code formatter with empty lines at the end of the code (de10bbd).
  • BUGFIX: High memory consumption while parsing some PE files (af18dbc, #443)
  • BUGFIX: Prevent panic when assertions like \b and \B are used in Unicode regexps (0536ad1).

Contributors: @1ndahous3 @jtpox @vojone

v1.6.0

05 Sep 08:13
c54e467

Choose a tag to compare

  • Implement --no-mmap option for disabling the use of memory-mapped files (9ff675f).
  • Support relative includes for compatibility with YARA (89674f1).
  • Support metadata validation using regular expressions (#434).
  • Added support for global variables of type dict in the Python API (#433).
  • BUGFIX: Detect circular includes and raise an error instead of panicking (624429f).
  • BUGFIX: Issue in hoisting algorithm causing false-positive in some with statements (f0f5b0a).
  • BUGFIX: Multiple issues with Python stub file yara_x.pyi (4d83594).

Contributors: @nmbarel @prosperritty @zdiff

v1.5.0

08 Aug 09:55
ab1ae5c

Choose a tag to compare

  • Implement the crx module for parsing Chrome Extension files (#423).
  • Allow underscores in integer and float literals (#405).
  • Adopt Anomali's symhash algorithm for Mach-O files (#425).
  • Support boolean type in console.log() (#406).
  • Allow specifying include directories in the C, Go and Python APIs (45a03c6).
  • Improvements while parsing imports and exports in Mach-O files (#417, #421).
  • Improve performance for patterns with the xor modifier. The performance gain can be noticeable for certain rules (0122fa9).
  • Return an error with rules that can have arbitrarily long prefixes (c8bbede).
  • BUGFIX: Fix misleading help text in text_as_hex warning (e61a74e).
  • BUGFIX: Minor formatting issues in yr fmt command (43fbdc5).
  • BUGFIX: Fix panic when a rule contains an invalid regexp and the rule name is reused (a50f3db).
  • BUGFIX: Fix panic with regular expressions that contain too many alternatives (7ad6d8f).
  • BUGFIX: Make some functions in cuckoo module backward-compatible with YARA (#424).

Contributors: @MichaelTheSynthCat @latonis @wxsBSD @1ndahous3

v1.4.0

10 Jul 07:44
dc1b5bd

Choose a tag to compare

  • Allow suppressing warnings using // suppress: warning_id comments (#398).
  • Implement built-in functions float32, float64, float32be and float64be (#396).
  • BUGFIX: fix wrong text_as_hex warning (0baf08b, #397).
  • BUGFIX: false positive in wide regular expressions (5fd5015, #395)

v1.3.0

02 Jul 10:23
ad1a459

Choose a tag to compare

  • Add span information to Event::Begin and Event::End (f4259f0).
  • Add support for private patterns. Private patterns were being accepted but ignored. (21a9090).
  • BUGFIX: add YRX_ prefix to constants in the C API to avoid name collisions (#382).
  • BUGFIX: increase MAX_ATOMS_PER_REGEXP from 8192 to 10000 (#387, 664abac).

v1.2.1

18 Jun 17:02
02d649b

Choose a tag to compare

  • BUGFIX: regression introduced in #368.
  • BUGFIX: more robust LNK file parsing than handles maliciously crafted files (7e1c8b3, #379)