[Forensics-changes] [yara] annotated tag v3.4.0 created (now 5bd0992)
Hilko Bengen
bengen at moszumanska.debian.org
Sat Jul 1 10:29:11 UTC 2017
This is an automated email from the git hooks/post-receive script.
bengen pushed a change to annotated tag v3.4.0
in repository yara.
at 5bd0992 (tag)
tagging 040db952d484dea406ed7d4e622f7b8ba9b683cb (commit)
replaces v3.3.0
tagged by Victor M. Alvarez
on Thu Jun 18 15:57:55 2015 +0200
- Log -----------------------------------------------------------------
Andy Wick (1):
Missing close parenthesis
Antonio S (1):
Removed from .gitignore file m4/acx_thread.m4, needed to compile
Christian Blichmann (1):
Do not recompute match chain lengths
Domingo Kiser (1):
Adding examples specs for yara/yara-python rpm's.
Hilko Bengen (13):
Add a simple read-only stream abstraction that supports a fread(3)-like interface
Add yr_arena_load_stream function
Add yr_rules_load_stream API
python: Add simple test for yara.load(FILE-LIKE-OBJECT)
python: Add reader for file-like objects
Add workaround for link failure (undefined reference to '_time32') when cross-compiling with MinGW
Use GCC's -fvisibility feature together with YR_API definition instead
Add yr_filemap_map_fd API
Add yr_rules_scan_fd API
PE module: avoid segfault after failed allocation.
PE module: avoid off-by-one leading to segfault
PE module: avoid memory leak if there are no valid PKCS7 certs
Get rid of nonsensical configure.ac line that was introduced in f81493e36b82dfa88682884d2036b14fdea6be41
Ivan Kwiatkowski (1):
Update writingmodules.rst
Michal Malik (8):
Fixed midrule at $8 of 'rule' has no declared type
Merge pull request #1 from michalmalik/michalmalik-patch-1
Added constants concerning program headers
Merge pull request #2 from michalmalik/michalmalik-patch-2
Made program headers accessible from elf module
Merge pull request #3 from michalmalik/michalmalik-patch-3
Added PT_GNU_STACK
Fixed wrong version number (3.2.0) on Windows
Moritz Kroll (3):
PE module: Fix unchecked access to version info buffers
PE module: Corrected size of strings in checks
strutils: Made strcmp_w more exact (don't ignore upper byte of wide chars)
Nyx (1):
Fix the ARM architecture value
Olivier Houchard (1):
Don't try to memset() the allocated memory, if the allocation failed.
Rhys Elsmore (1):
Added Heroku as a user
Shane Huntley (6):
Fix memory leaks found using pe module.
Increase limits and dynamically allocate stack.
Fix bug where parsing (side effect in assert)
Stop iterating on resources when resource tables are corrupt.
also limit import numbers to prevent blowup
Mutex lock on is_loaded bitmask
Tian You (1):
Fix for running 'configure' in another folder
Victor M. Alvarez (98):
Fix issue #253
Merge pull request #256 from moritzkroll/pe-versioninfo-fix
Minor indentation changes
Merge pull request #252 from hillu/stream
Improve streams
Performance improvement. Write a large chunk of data instead of many individual bytes.
Merge pull request #257 from cognet/master
Avoid infinite loop with certain PE files
Fix wrong parsing of PE version info
Fix issue with "save" function not accepting unicode strings in Python 2.x
Add Websense to "Who's using YARA"
Implement short-circuit evaluation
Merge pull request #268 from axqd/patch-1
Merge pull request #263 from hillu/mingw-workaround
Merge pull request #276 from cblichmann-google/no-recompute-chain-lengths
Initialize new_match->chain_length
Merge pull request #278 from shanehuntley/leakfix
Merge pull request #279 from shanehuntley/newlimits
Fix memory leaks
Don't use "result" variable for temporary values other than function result
Avoid integer overflows in fits_in_pe macro (issue #277)
Stricter boundary checks in PE module
Fix minor style issues
Merge pull request #274 from hillu/symbols
Prepend yr_ prefix to min and max to avoid conflicts in C++ programs
Merge pull request #284 from wxsBSD/resource_regression
Show warning for potentially slow loops
Revert "Show warning for potentially slow loops"
Merge pull request #285 from shanehuntley/parsefix
Merge pull request #287 from orangetoaster/master
Improve profiling
Merge pull request #289 from JusticeRage/patch-1
Merge pull request #291 from shanehuntley/pememleak
Merge pull request #294 from wxsBSD/print_module_data_fix
Simplify code and avoid exceeding the 80 characters per line limit
Merge pull request #275 from kai5263499/master
Merge pull request #296 from hillu/crash
Minor style changes
Fix issues with PE files having a corrupt header with wrong number of sections
Add improvements suggested in pull request #282
Merge pull request #299 from hillu/crash
Merge pull request #302 from plutec/master
Merge pull request #298 from wxsBSD/module_data_option
Minor style changes
Merge pull request #293 from michalmalik/master
Merge pull request #304 from shanehuntley/lock_fix
Perform stream I/O tests without relying on a predefined compiled file
Handle empty strings correctly (issue #303)
Remove the "is_loaded" field from module entries to avoid multithreading issues.
Merge pull request #283 from hillu/scan-fd
Add YR_ prefix to FILE_DESCRIPTOR
Add missing typecasts causing warnings in Visual C++
Get rid of designated initializations as MS Visual C++ don't support it
Add stream.c to Vistual Studio project
Fix issues in yara-python while compiling in Windows
Fix bug while writing to streams in Python 3.x
Add missing typecasts
Stricter file version check
Use flex 2.5.39 to avoid calls to exit() from inside the parser (issues #267 and #272)
Add Gitter's badge
Merge pull request #308 from hillu/master
Merge pull request #307 from wxsBSD/osquery
Optimize _yr_rules_clean_matches
Fix bug introduced in previous commit
Faster matches cleanup
Merge pull request #312 from rhyselsmore/master
Fix bounds check for iterating over certificates
Add thread index (tidx) to scan context
Merge pull request #310 from hillu/master
Merge pull request #313 from awick/patch-1
Fix bug while reading from streams in yara-python
Optimize mapped files for sequential access
Merge pull request #309 from nyx0/master
Remove extra spaces
Merge pull request #238 from dkiser/rpmspec
Update RPM spec
Update documentation
Make "save" and "load" methods more coherent with existing "match" and "compile"
Revert commit 9c60ecb2e2d11e136d31ccff155d833f4d3d9a1d
Implement non-greedy range quantifier in regular expressions
Fix an issue with certain regular expressions reporting matches longer than expected.
Better atom extraction when using {n,m} quantifiers
More test cases for regular expressions
Update yara-python documentation
Add missing typecast
Include gcc-specific pragma only when compiling with gcc
Rename some ELF segment's fields to match naming convention used in PE module
Add missing #endif directive
Remove unused variable
Fix issue #319
Update documentation
Update documentation
Improve printing layout for yr_object_print_data
Change --print-module-info to --print-module-data
Document new command-line options
Avoid warning due to unused variable when profiling is disabled
Fix warnings
Set version number to 3.4.0
Victor Manuel Alvarez (12):
Fix issue #258
Put a link to yextend
Fix grammar error
Put reference to yextend in a separate paragraph
Remove execution permission from some source files
Fix issue with short-circuit evaluation
Add x64dbg to list of projects using YARA
Add Hilko Bengen to AUTHORS and CONTRIBUTORS
Add Raytheon to "Who's using YARA"
Fix memory leak
Homogenize style
Add Koodous to "who's using YARA"
Wes Widner (1):
fixed build on freebsd 10 with a conditional #define so that warnings are not introduced in other builds
Wesley Shields (6):
Fix regression in pe_collect_resources().
Fix PRINT_MODULE_DATA.
Print non-printable characters in hex.
Implement -D (--print-module-info).
s/SHOW_MODULE_INFO/SCAN_FLAGS_SHOW_MODULE_INFO/
Add osquery to list of projects using YARA.
nyx0 (2):
Add Linux et Mac files to .gitignore
Add more architectures to support
orange.toaster (2):
Corrected NDEBUG version of assertf macro to have the same definition as the DEBUG version.
Included stdint.h for uint16_t, required for more strict compilers.
-----------------------------------------------------------------------
This annotated tag includes the following new commits:
new 4dc0442 Fix issue with ^ anchor in regular expressions used with "matches" operator. Make yr_re_exec easier to read.
new 345bf84 Fix bug in yr_re_exec logic
new 372ce64 Fix warning about uninitialized variable
new 24d001d Fix buffer overflow
new c9d6d93 Fix bug causing segmentation fault when using nested loops
new 9cae43b Add test case for nested loops
new f22999b Enable optimization settings
new e87621b Fix typo
new a5736f9 Add Bayshore Networks to "Who's using YARA"
new 74ca113 Fix issue #127
new bfe9980 Fix segmentation fault caused by invalid characters in regular expressions.
new 08c8456 Fix bug in regular expression engine causing false negative matches
new f1999cb Fix bug while handling nested includes
new 01bb023 Add ThreatStream to "who's using YARA"
new 74a7e4e Fix issue #131
new 67eb56c Fix bug introduced in commit 08c8456a0728522b347e936f66b98676a890cd09
new efd5b45 Remove unused prototype.
new 79304f3 Fix issue caused by regexp code spanning over non-contiguous arena pages
new 0ce0d33 Adjust value for RE_MAX_CODE_SIZE
new cb4d544 Fix minor issues in arena.c
new 3216460 Minor style fixes
new 89cde68 Implement profiling support
new f0e80c7 Fix wrong #ifdef
new 035b2a2 Avoid segfault while scanning some processes in Windows
new ee6289b Increment initial arena sizes to reduce the number of memory allocations
new e13a5bc Merge pull request #134 from wxsBSD/master
new af78ed3 Add Fox-IT to "who's using YARA"
new f884da4 Update README.md
new f6d91d7 Fix issue with files larger than 4GB
new 13096f3 Merge pull request #137 from kcreyts/patch-2
new f40567a Add Blue Coat to "Who's using YARA"
new a890012 Implement modules support
new bd40304 Add subdir-objects to automate options
new 1d65669 Fix bug caused by missing flags initialisation while splitting a regular expression
new 51aeb0e Fix issue with undefined strings
new f81eeaf Fix bug in yara-python
new fcc71e0 Remove unnecessary code
new 3344ada Fix issues with includes
new 3773bb1 Fix bug in yara-python causing segmentation faults
new 7690f84 Rename YR_EVALUATION_CONTEXT to YR_SCAN_CONTEXT and some other minor changes
new d907fdd Rename YR_EVALUATION_CONTEXT to YR_SCAN_CONTEXT and some other minor changes
new 26c456d Add more test cases
new 65170ff Remove unnecessary file
new f5c045a Calculate pe.entry_point value differently for file and process memory scans
new 82b2c61 Rename token SIZE to FILESIZE to avoid conflicts with windef.h in Windows
new 7857a47 Put leading and trailing underscores to tokens, to avoid conflicts with other types and macros
new 609ee5a Add missing includes in Windows
new 6a11508 Fix compilation in Windows
new b41d264 Add missing Jansson files
new a9dd9e4 Fix bug in PE module caused by misplaced break
new b056a7d Fix bug in Window's version of is_directory function
new f609e10 Set multi-byte character set for Windows projects
new b0b3c7f Fix problem with string matches offsets not being treated as virtual addresses while scanning a process
new c864034 Setup new documentation
new 86b09b4 Rename modules/list to modules/module_list
new 7fdcb84 First draft of documentation
new a9fd7f2 Replace uint8_t* type with RE_CODE for regular expression code
new 044be47 Add demo module
new c285e54 Add string_array macro to modules.h
new 4ff1b48 Add more tests and remove unnecessary #undef directives
new 0780c6e Fix issue with documentation config in readthedocs.org
new 3c577a7 Update documentation and remove old one
new 912bb62 Add first_memory_block macro
new a8ddf6f Update documentation
new 2f16c3a Make scan context accesible to module functions
new 9575382 Update documentation
new b86ef21 Implement exports() function in PE module and add support for 64-bit PEs
new c4ae098 Implement imports() function and other small changes in PE module
new 0c1a27a Rename self() to parent() and add module() to module's API
new f3e8b0f Update documentation
new 8552b47 Add test case for functions in modules
new 077fba2 Add Blueliv and Adlice to "Who's using YARA"
new 1387428 Remove dmalloc from config.h
new e33266d Fix issues with parent() in Cuckoo module
new f8fd52d Enable optimisations by default
new 285d538 Fix warning about uninitialised variable and add assert
new ec5eb9f Bug fix: Start of string anchor (^) not working properly with wide strings
new 7958ed4 Add extern "C" directive to yara.h
new 6751779 Raise warning when the deprecated "entrypoint" keyword is used
new 70852a8 Add declare_ prefix declaration macros to avoid collision with type "string" in C++
new 425dade Implement yr_compiler_set_callback
new 92e1c36 Rename YR_COMPILER_CALLBACK to YR_COMPILER_CALLBACK_FUNC
new d06a778 Remove yr_compiler_push_file_name from the public API
new ba112e0 Update documentation
new 57ef744 Fix issue #147
new 33bd8fd Fix issue #148 by asserting that yr_compiler_get_rules was not called before yr_compiler_add_file/yr_compiler_add_string
new d75fc00 Change some "char*" to "const char*"
new d972eed Update exported symbols
new 6d1a26b Implement iteration macros
new 8e869c6 Replace fast_scan_mode boolean argument with flags for greater flexibility in the future
new 91f4e74 Update documentation
new c195f6f Update documentation
new 37bdd55 Fix typo
new 542c955 Document the command-line -x option in the man page and add example to documentation
new 35d9ce6 Release version 3.0.0
new 8cc6a99 Add missing patch version
new 8e85126 Fix some issues while compiling in Windows
new dcf80f7 Update version number in documentation
new 36dadb0 Update writingmodules.rst
new 48c43c5 Merge pull request #151 from corumir/patch-1
new a9db0ea Update documentation
new 2eaafa8 Fix buffer overrun in PE module
new 2dd8274 Improve buffer bounds checking in PE module
new e6db404 Fix non-escaped characters in documentation
new 3b5ddd0 Replace WIN32 with _WIN32. The latest is defined by the compiler and doesn't need to be defined externally.
new 797c485 Show appropriate error message when importing an unknown module
new 68d8a49 Fix issue #157
new 5274d45 Added Homebrew installation instructions.
new 500e588 Merge pull request #158 from sroberts/patch-1
new 7b3f904 Remove reference to yara-python installation with PIP
new d5ed62e Implement module_initialize and module_finalize
new f56608c Improve error handling
new 1c5ac31 Fix issues introduced in yara-python
new 75139e2 Handle zero-length files as normal files and remove zero-length errors.
new 5e3282b Fix some warnings
new 2d04878 Improve error reporting when a function is called with wrong number of arguments
new a22f289 Accept functions without arguments
new ac87a92 Fix double invocation side-effect when passing a function to return_string() macro, like in return_string(f(...))
new 61f517d Implement "magic" module based on Armin Buescher's original idea.
new f329724 make 'dns_lookup' usable
new 0de8878 Merge pull request #161 from billmarczak/master
new bc3bc53 Fix issues with Bison 3.0
new a7c1dc2 Fix issues with Bison 3.0
new 174cda2 Homogenize newlines at the end of files
new 829348a Add missing newlines at the end of files
new b274520 added new libyara headers to yarainclude_HEADERS
new 689c41d Merge pull request #163 from swdunlop/master
new a85a72f Use strlcat, strlcpy, and snprintf instead of strcat, strcpy and sprint to avoid warning in OpenBSD
new 8df08b8 Use strlcat, strlcpy, and snprintf instead of strcat, strcpy and sprint to avoid warning in OpenBSD
new d196b97 Provide an implementation for strlcat and strlcpy and use them where appropriate
new 87df834 Fix bug introduced in previous commit
new 3daf2bd Update the documentation
new ffc0a33 Replace WIN32 with _WIN32
new 03b015e Don't generate debug information for release version
new 3462b7f Release version 3.1.0
new 9c71ec1 Update README file
new 356e013 Remove unnecessary files
new a6ad94b Add config.h for Windows
new 41493c9 Fix #164
new 80b340b Fix issue #165 by reorganizing header files
new 1ed3d39 Fix wrong file name in Makefile.am
new 6d2dee1 Fix wrong file name in hex_lexer.h
new 8b51e22 Fix wrong includes
new 3f97c63 Fix wrong includes
new 0cbd3d2 Add missing include
new d6b4afe Add missing include
new c9622ab Implement ELF module
new ab30621 Document ELF module
new 1bbc215 Return error when declaring duplicated structure members
new cbd096f Fix typo. "Duplicated" instead of "duplicate".
new 367b0ea Implement resources parser and language identification in PE module
new a5a8b51 Improve scanning speed by matching certain strings only at fixed offsets
new 4a0e558 Fix bugs in previous commit
new 76dee58 Fix issue #169
new b0b592d Fix issue #171
new 0bff066 Implement dictionaries
new b746e50 Implement .version_info dictionary in PE module
new b82ad28 Add Tanium to the "who's using YARA" list
new cd54bea Fix "duplicate structure member" error in elf.
new 39fcd4a Merge pull request #174 from wxsBSD/elf_fix
new 4a73f8b Start to implement rich_signature.
new 4c08d65 Implement rule iterators.
new 430b941 Implement "matches" for strings.
new 2446f23 Merge pull request #175 from wxsBSD/rule_iter
new 903ba46 Remove dead code.
new 72f0cc5 Implement overloaded functions
new f002d92 Implement "locale" function in PE module and improve buffer bounds checking
new 80eeb8e Implement module data printing
new 81ff989 Fix issues in PE module
new b85adb0 Add 'begin_struct_dictionary' and 'end_struct_dictionary'
new 97ea49c Update documentation
new a8eccdd Fix typos
new 7a83bd9 Fix uninitialized variable warning
new 86ec8c7 Fix uninitialized variable warning
new 77082a6 Merge branch 'master' into richpe
new 55c6c83 Use IMAGE_FILE_MACHINE_AMD64 appropriately.
new f4b2c31 Use IMAGE_FILE_MACHINE_AMD64 appropriately.
new 6a1c56a Merge pull request #178 from wxsBSD/IMAGE_FILE_MACHINE_AMD64
new 55ee00d Implement yr_rules_foreach and use it where appropriate
new 5ae1a05 Update documentation
new 1b48ae8 Merge branch 'master' into richpe
new 2a61599 Revert string_argument being SIZED_STRING.
new a25f996 Chase string_argument revert.
new 9dea8c6 Use ACX_PTHREAD macro for configuring PTHREADS
new d15585f Fix issue #180
new c8d9821 Fix warning due to uninitialized variable
new 5ade2bf Fix warning due to a wrong format specifier for printf
new 1c8b82e Use calloc() instead of malloc().
new 6df98c0 Implement import hashing.
new 3c95eca Merge branch 'master' into richpe
new c31b756 Fix missing IMAGE_FILE_MACHINE_AMD64.
new 8f3866f Use -lcrypto.
new 9c00c3d Remove comment that is OBE.
new fd30212 Remove comment that is OBE.
new bf6ce6a Pass length of string properly.
new a19faec Fix comment.
new 4db20e7 Improve ACX_PTHREAD usage
new 0763b7a Fix issue #181
new 9f7a178 Fix segfault in yara-python
new c20bac2 Rename cur_rule to iter_current_rule
new 5ed3203 Improve detection of strings slowing down the scanning
new c80a56b Improve atom quality calculation
new 7e99c64 Fix bugs while parsing PE version information
new 362c667 Switch from using OpenSSL to stand-alone MD5.
new cde939e Merge branch 'master' into richpe
new 719995c Fix early returns.
new 21cc617 Add some sanity checks to resources iteration routine in PE module
new f37e97e Improve atom quality calculation
new e5369ca Avoid stack overflow
new ff6646c Implement sha256 of rich signature.
new 4a65288 Merge branch 'master' into richpe
new 55c0280 Remove unnecessary assignment.
new f3722ba Fix one-byte overflow.
new ae6f8a4 Declare lexers as never-interactive
new ce43573 hash module
new 09b306f Fix multiple warnings when compiling as C++
new c2a36b6 Fix multiple warnings when compiling as C++
new 4f3c9a0 Fix pe.h
new 88a25d2 Function 'input' is called 'yyinput' in C++
new ce8f8c4 Remove DirectoryEntries from IMAGE_RESOURCE_DIRECTORY
new 925da0d Add YR_API macro for declaring functions as extern "C" in C++
new f698147 Fix minor issues while compiling in Windows
new d4e5eb8 Fix warnings in while compiling in C++
new 5af437a Update Visual Studio projects to use C++ instead of C compiler
new c82cc9e Merge pull request #183 from karlhiramoto/hash
new b34c0db Fix minor style issues in modules/hash.c
new c9fd5ab Fix copy/paste mistake.
new a9d7b78 Merge branch 'master' into richpe
new c0c1761 Add Wesley Shields to AUTHORS and CONTRIBUTORS
new 7afe1c3 Merge branch 'master' into richpe
new bf5a1e4 Implement yr_calloc() and switch yr_malloc() back.
new 8b56f40 Address concerns around set_string().
new 0820967 Merge pull request #184 from wxsBSD/richpe
new 3a8bd42 Fix issues with pull request #184
new 326c09f Comply with YARA's style
new 2338e6c Use OpenSSL to calculate hashes and change prototypes for "richhash" and "imphash"
new 95c8160 Refactor parse_imports to to reduce complexity and indentation levels
new 2fe67ce Homogenize comments
new 6e1b851 Fix build on OS X.
new ea89d01 Merge pull request #185 from wxsBSD/pe_parse_imports_fix
new 77ad1e7 Fix a copy/paste mistake in richhash.
new 10d1c97 Merge pull request #186 from wxsBSD/length_fix
new 561f61e Replace htonl with bigendian macro
new fda7ef9 Remove unused variable
new 3ea3db2 Fix misplaced constants
new 50f598d Start to implement certificate parsing.
new a1fe3e1 Cleanup comments, fix leaks, etc.
new fbafd23 Remove old comment.
new f9fbd86 Issue warning on regular expressions containing .*
new c815301 Minor improvements in PE module
new d3f2707 Add missing include
new 2b73387 Merge branch 'master' into authenticode
new 96e6d9e Implement yr_strndup
new df87f7e Fix possible buffer overrun
new a7ce07e Remove references to "aprintf" and fix a memory leak
new cdadb9e Fix warning
new 1c0968d Fix wrong boundaries check causing segfault
new 7e3156f Fix serial handling.
new a89b293 Merge branch 'master' into authenticode
new 3797107 Fix a NULL ptr deref.
new d8b14f6 Merge branch 'null_ptr_fix' into authenticode
new a679710 imphash returns a string.
new 97faa69 Merge branch 'null_ptr_fix' into authenticode
new a2eef63 Properly calculate the next certificate entry.
new bd6dac6 Merge pull request #188 from wxsBSD/null_ptr_fix
new 195a022 Merge branch 'master' into authenticode
new 7c2d090 Fix some bugs.
new b2e9cd0 Fix length check. The docs are confusing.
new 5c32607 Add extra comment explaining why this check most likely fails.
new 88624bc Make length check bounded to directory.
new d8a2bc2 Cleanup bounds checks and comments.
new 0f26410 IMAGE_SECURITY_DESCRIPTOR -> WIN_CERTIFICATE
new a6f3e43 Fix comparisons.
new e9ba9c2 Remove unnecessary code.
new 438430a Add Trend Micro to "who's using YARA" list
new 3939b90 Merge branch 'master' into authenticode
new 4be9088 Implement signature as an array.
new fe83cf1 Fix bug where array length was off by one.
new 1e04878 Conditionalize the counter decrementing.
new 86db33c Pluralize "signature" and use "number_of_signatures"
new 6fc5eed Use not_before and not_after.
new b89c211 Track ASN1_TIME structures in a list.
new 5aa4262 Free stack of certs.
new aaee659 Detect presence of OpenSSL library and build accordingly
new a2d920a Merge branch 'master' into authenticode
new 62d8318 Fix some warnings and errors while compiling on Windows
new d2b98fe Implement "memmem" function and fix minor style issues
new deff68d Add missing semicolon
new c8b74ed Fix warning
new 5ba87be Add OpenSSL to Windows project
new 0d4d719 Fix bug in overloaded functions
new a039141 Replace tabs with spaces
new 3c4b246 Fix issue with functions declared in a structure contained in an array
new 083ec11 Merge branch 'master' into authenticode
new 9057a81 Adhere to upstream style.
new 3e260f3 Fix issue #195
new f901baa Fix warning caused by comparison between integer and pointer
new ccd52bc Fix string_argument macro to correctly handle SIZED_STRINGs
new 557aa9a Add test case for functions receiving strings
new 592d2ff Merge branch 'master' into authenticode
new 9214193 Implement overloaded not_before() and not_after().
new b5a4229 Fix problem from cherry-picked commit.
new b86a6f6 Return error if hex strings are too long
new 7f31078 Merge branch 'master' into authenticode
new 8c1ce59 Use HAVE_LIBCRYPTO.
new 10d6554 Make not_before and not_after be integers.
new c8f03ac Implement valid_before() and valid_after().
new 9a70c64 Implement valid_on().
new eafd5b5 Merge pull request #191 from wxsBSD/authenticode
new dda6c74 Move utility functions out of pe.c and other minor changes
new 5f39dcc Use statically allocated buffer with X509_NAME_online.
new bcabb68 Simplify the serial number length computation
new 3455dc7 Fix wrong identifier
new 0e67efe Remove unnecessary counter decrement
new 59b643b Remove unnecessary call to BIO_set_close, BIO_CLOSE flag is set by default
new 42236e6 Fix some possible memory leaks
new 4344883 Add Metaflows to "who's using YARA"
new 65403b5 Change some char* to const char*
new 88088c0 Check for memmem function during configuration
new 93cce90 Add missing define
new 7bf0c83 Fix bug in "imports" function of PE module
new 46fee1a Improve sanity checks in pe_parse_certificates
new f678d4b Fix bug introduced in previous commit
new 987b81d Address an import parsing problem.
new 2dc3473 Merge pull request #197 from wxsBSD/import_fix
new 395daec Fix false positive in "fullword" matches when string is declared both "ascii" and "wide"
new 11c7825 Implement timegm for platforms not including it
new 1ab5a43 Make WIN_CERTIFICATE declaration available in Windows
new 2f31e89 Simplify "valid_on" function and remove "valid_before" and "valid_after"
new 400a62c Merge branch 'master' of https://github.com/plusvic/yara
new f006dc8 Fix incorrect handling of undefined boolean expressions in a for loop
new 0cd95ae Implement functions sha1 and sha256 in "hash" module
new 6832b36 Improve sanitation in PE module to avoid segfaults
new dd2afc6 Sanitise DLL names in import table and fix memory leak
new 5efae9c Improve DLL name validation by rejecting empty names
new ab2d2df Add big-endian versions for intXX and uintXX functions
new ac33844 Include "offset" and "length" in pe.rich_signature and remove "start"
new accf5e1 Add missing type check
new d79d7b6 Add missing type check
new 2d93221 Implement hash functions receiving string arguments
new 86c4afb Remove "hash" function from "rich_signature"
new d293513 Check for undefined arguments in hash functions
new 72136d8 Update documentation
new 72af49a Improve legibility of hash module
new 76bfdec Implement "checksum" function
new 3b2b9fd Update documentation
new f3edcf2 Improve syntax error recovery
new ba58fe2 Bump to version 3.2.0
new 5480ab8 Add missing library to setupwinXX.py
new 344d27a Increment ARENA_FILE_VERSION
new 81f4349 Fix segfault with some syntax errors and improve error reporting
new 5cb324a Fix a problem with ord_lookup.
new 01dfe38 Merge pull request #199 from wxsBSD/ord_lookup_fix
new aff604d Fix issues when using dmalloc
new 8e55590 Fix memory and handle leaks
new 2aeb167 Avoid segfault when yr_re_finalize is called before yr_re_initialize
new f51c608 Use argparse library to parse command line arguments and some other improvements
new 141db64 Fix incorrect initialization of thread_storage_key in Windows
new e6db3bf Fix warnings
new dc71f72 Use integer arithmetic instead of floating point operations and fix problems in C++
new c637143 Update Visual Studio project
new 3234c4b Implement --pring-namespace commad-line argument
new 116b5e1 Replace argparse with my own argument parsing code
new 08f9871 Fix segfault in PE module
new c0628c8 Fix --timeout argument to work with directories
new cce7c5d Initialize timeout with a large number
new 7cc63b1 Avoid hitting a bug in lldb-320.4.152
new eb3e20a fix: compilation error because of multiple function declarations
new 089eb65 Merge pull request #203 from pozdnychev/master
new a292777 Accept None for argument "externals"
new a9bbb79 Fix issues while building in some systems
new d23f884 Fix warnings
new f6c24df Fix warnings
new d3a1fff Fix issue in Python 2.4
new 2773c9b fix issue #206
new 47ff529 internals: use ERROR_SUCCESS and ERROR_INSUFICIENT_MEMORY instead of 0/-1
new 7297977 Fix incorrect line number for syntax errors after a regexp declarations
new fbeada1 Merge pull request #207 from pozdnychev/master
new 279ae0b Minor style changes
new 2524d0c fix: data leak in case of error in yr_process_get_memory
new 9ae81c0 Merge pull request #209 from pozdnychev/master
new 0bb3273 Minor style changes
new a3af96a Update Windows project
new a430718 Fix some issues while compiling in Windows
new 0434bb9 Fix compile error due to undefined identifier
new 56566c5 Fixed command to install yara-python extension
new 963f1ba Fix issue #213
new c8c0925 Improve resource handling and add entropy.
new a64c155 Merge branch 'master' into resource_name_and_entropy
new f0ea82a Merge pull request #214 from ortizmj12/patch-1
new 6280cd4 Fix segmentation fault in ELF module
new a7b6dfe Fix bug in PE module
new dd4f0cc Start to implement double support.
new a51eaf2 Merge branch 'master' into resource_name_and_entropy
new 181f206 Fix incorrect cast.
new 161e324 Fix issue #218
new 3bc5efd Error message instead of triggering assertion on certain syntax errors
new 6869686 Remove debugging statement.
new 82a4212 Fix segfaults in PE module
new 86d991e Add new instructions for working with doubles.
new bbc0ae6 Merge branch 'master' into resource_name_and_entropy
new a5e0f8f Remove unused macros.
new 963b1a5 Add a DO_CASTS macro.
new efa92a6 Forgot to commit this in previous one.
new 6e6b906 Implement get_double().
new f3b9bd3 Merge pull request #215 from wxsBSD/resource_name_and_entropy
new 4a354cf More coherent instruction names
new 682d4d4 Rename CLEANUP macro to a more meaningful name
new 133df5c Fix minor style issues
new 6bb131d Fix regression issue
new 4e4b784 Add offset to resources and switch to length.
new d5b071c Remove "data" from resources.
new d84e0f9 Merge pull request #224 from wxsBSD/entropy2
new 1e28720 Start to rename entropy to math.
new 37ab9a3 Rename module.
new 912bf6c Simplify grammar.y by introducing yr_parser_reduce_operation function
new fd20014 Small improvements in exec.c
new 3149381 Implement operators >=, >, <, <= for strings
new 9784167 Add test cases for string comparison operators and floating point arithmetic operations
new d9f7e2c Fix bug in multiplication
new 45352ea Remove dead code (issue #225)
new 2fcfa86 Implement a cleaner solution to push_dbl and pop_dbl and avoid warnings.
new 65437b5 Check for math library in configure.ac
new befaa7c Add arithmetic mean and abs/fabs.
new e880c59 Merge branch 'master' of https://github.com/plusvic/yara into entropy_rename
new a761daf Implement serial correlation.
new df8d49d Implement Monte Carlo from Pi test.
new e98e08d Remove fabs() and abs().
new bb6bb84 Fix issue with undefined floating points values
new c2a4d45 Rename break_if_undefined to ensure_defined
new e275dcb Check function arguments for undefined values before calling the function.
new d2044aa Implement a function to check for undefined values. Minor improvements in PE module.
new f2f206c Re-implement valid_on using new is_undefined function
new ea84299 Change to "mean_err" and make it take an expected value.
new e8047b1 Implement mean_deviation.
new 4f8a039 Implement declare_double() and set_double().
new 35fa585 Define MEAN_BYTES as 127.5.
new 6e1f6ca Move from mean_err() to just mean().
new 65cff67 Rename to just deviation().
new a563875 Implement in_range(), which is inclusive.
new e6ff7e5 Merge branch 'master' into entropy_rename
new 4062f05 Remove IS_UNDEFINED checks after e275dcb6.
new 2e24d70 Add all known Machine types.
new a8d6eea Use the OptionalHeader.Magic value.
new 134fceb Stop using UINT_TO_PTR macro
new 9890eb4 Fix warning due to declaration inside switch statement
new 0e652fb Merge pull request #227 from wxsBSD/entropy_rename
new 03b7055 Remove unused variable
new 4f5c657 Minor style changes
new a208f42 Simplify serial correlation functions.
new 5b117b6 Add support for negative numbers
new af80d46 Handle negative array indexes correctly
new ba91e84 Fix warning due to uninitialised variable with certain compilers
new 962d5df Fix warning due to uninitialised variable with certain compilers
new 9d1c14a Fix bug while handling negative integers
new 100405e Merge branch 'master' into issue_231
new da309b7 Penalize spaces and newlines in strings
new 2705515 Include terminating NULL character in strings written to sz_arena
new 6b6b771 Comment previous change
new b019227 Fix bug while handling dictionary objects
new e378aa1 Fix previous commit, the operation should be decrement instead of increment
new 35f0961 Merge branch 'master' into issue_231
new 334bd1a Add support for pkg-config
new 111133d Rename double to float
new f1fe727 Fix issues with previous commit
new c1cf3df Merge branch 'master' into issue_231
new 0bd0fa9 Add section characteristics.
new e82821d Remove extra semicolon
new 3b87282 Implement section_index_addr().
new cfbe125 Remove old line I was using for debugging.
new f4b4ad1 No need to add image_base.
new b3d1df4 Use virtual_address and virtual_size when scanning memory.
new 7f7487d Expose new constants in PE module.
new 9a282e6 Remove unused integers.
new b8cfec8 Add docs for new stuff.
new 81f3ae4 Remove "often", it's ambigious.
new 6daa528 fix: check return values of memory allocation functions
new 032c394 Update yarapython.rst
new 3a4776a Adding examples specs for yara/yara-python rpm's.
new 922ecec Fix 32BIT_MACHINE issue.
new fe0c3b9 Rename to MACHINE_32BIT.
new f382799 Update docs to reflect 32BIT_MACHINE change.
new 60e7e28 Merge pull request #244 from wxsBSD/issue_243
new a86dad9 Merge pull request #236 from SleuthKid/patch-1
new 6ac4fa5 Merge pull request #234 from wxsBSD/docs
new eccb434 Merge pull request #232 from wxsBSD/issue_231
new 73ebddb python: Add explicit library path
new d7ed1c0 Fix build on kFreeBSD
new aaefdb2 python: Fix crash when Python 3 cannot decode strings from tags or meta as UTF-8
new 81ec39e Fix crash on warnings when no compiler callback has been set.
new d502157 Merge pull request #241 from hillu/master
new 1a5c369 Comply with the 80 character per line style rule
new 7072092 Add missing underscore in function name
new 61be5ca Revert wrong attempt to fix issue #240
new b90e8b5 Allow to pass custom pointer to compiler callback as suggested in #220
new 25eab58 add radare2 to list of people using yara
new 1344b55 Merge pull request #245 from crowell/patch-1
new 9990a87 Fix incorrect version number in the documentation
new c0f94f6 versionadded: and versionchanged: directives must contain version numbers only
new 83f39b4 Fix copy/paste mistake in docs.
new 6cd9fad Implement unary minus operator
new 8ebfeee Fix bug in bitwise not (~) operator
new 925cc8b Make operator precedence compatible with the C language.
new 88f2ed7 Fix an off-by-one memory access
new 9198ce6 Implement \b and \B anchors in regexps
new 76fa8a2 Abbreviate code in re.c
new 63659a6 Merge pull request #247 from wxsBSD/doc_fix
new b6bccf3 Fix issue #249
new 5c8007c Declare loop variables in the "for" statement
new d16e628 Remove unused functions
new 4d00494 Fix issue with strtoll when compiling in Windows
new d6c4f83 Add some definitions missing in older versions of WinNT.h
new 5d9a69d Don't use stdbool.h as it doesn't exists in VC++
new d0a9aef Implement log2 function for VC++
new 964a797 Avoid warning due to ambiguous call to overloaded log()
new fbb48a4 Implement yr_filemap_map_ex
new a546391 Fix some issues with latest changes in filemap functions in Windows
new 88a0417 Add missing definitions in Windows
new 8986478 Update Windows project
new 137981f Merge pull request #235 from pozdnychev/check-allocation
new a5d77f3 Improve error handling in atoms.c
new 2c1c67c Improve error handling in low memory conditions
new febeaa2 Fix a segfault under low memory conditions
new ff789c0 pe_utils.c: Add missing include for defining struct tm
new 3474bd7 yara-python/tests.py: Add missing f.close() to avoid warning
new afa5344 Merge pull request #251 from hillu/python3-test-fix
new 73f1447 Merge pull request #250 from hillu/mingw-cross-fix
new d0cabe7 Merge pull request #233 from wxsBSD/section_characteristics
new 2540594 Don't show bug report message when printing version information
new 59974ef Set version number to 3.3.0
new 1a0a898 Update documentation
new b0d0494 Merge pull request #228 with some improvements
new a78f4c9 Define section characteristics constants as they appear in winnt.h
new 7af1706 Fix issue #237
new d1fa24b Fix buffer overrun
new e55f989 Implement float external variables
new 93f9ff9 Disable warnings due to deprecated functions
new 4c0cdf9 Include version numbers in header files (issue #221)
new 0173d3a Replace CreateFile with CreateFileA (issue #205)
new 6468404 Fix an issue with test cases in Python 3.x
new 7fa2c1f Update Windows project
new ec05041 Merge branch 'master' of https://github.com/plusvic/yara
new 83d531c Update man pages
new 73098ae Fix issue #253
new 022221c Add a simple read-only stream abstraction that supports a fread(3)-like interface
new 324a421 Add yr_arena_load_stream function
new eb726b7 Add yr_rules_load_stream API
new 8776e41 python: Add simple test for yara.load(FILE-LIKE-OBJECT)
new 410c9cb python: Add reader for file-like objects
new 088fc84 PE module: Fix unchecked access to version info buffers
new 4b72a54 PE module: Corrected size of strings in checks
new 90d16f8 strutils: Made strcmp_w more exact (don't ignore upper byte of wide chars)
new b47a70f Merge pull request #256 from moritzkroll/pe-versioninfo-fix
new 316e5f2 Minor indentation changes
new 22cb508 Merge pull request #252 from hillu/stream
new ef7da2c Improve streams
new eb6c58a Performance improvement. Write a large chunk of data instead of many individual bytes.
new 3f91011 Don't try to memset() the allocated memory, if the allocation failed.
new 487a35f Merge pull request #257 from cognet/master
new 4994a2c Fix issue #258
new aa0f6c4 Avoid infinite loop with certain PE files
new b382dc0 Fix wrong parsing of PE version info
new 4203961 Fix issue with "save" function not accepting unicode strings in Python 2.x
new 3f56159 Add Websense to "Who's using YARA"
new 165c353 Implement short-circuit evaluation
new 83db30e Put a link to yextend
new a7e9f35 Fix grammar error
new 02d3c4c Put reference to yextend in a separate paragraph
new a4d33e2 Add workaround for link failure (undefined reference to '_time32') when cross-compiling with MinGW
new 55aa93b Fix for running 'configure' in another folder
new d03a673 Merge pull request #268 from axqd/patch-1
new d9ff226 Merge pull request #263 from hillu/mingw-workaround
new b58bb08 Use GCC's -fvisibility feature together with YR_API definition instead of separately maintained list for exporting symbols
new 6bd27e0 Remove execution permission from some source files
new 622e45c fixed build on freebsd 10 with a conditional #define so that warnings are not introduced in other builds
new 8b7eb76 Do not recompute match chain lengths
new d99f8e8 Merge pull request #276 from cblichmann-google/no-recompute-chain-lengths
new e654c40 Initialize new_match->chain_length
new bc9d5b6 Fix memory leaks found using pe module.
new 66229ac Increase limits and dynamically allocate stack.
new 48c4a2b Merge pull request #278 from shanehuntley/leakfix
new 5394e45 Merge pull request #279 from shanehuntley/newlimits
new 21e796d Fix memory leaks
new d4aa74c Don't use "result" variable for temporary values other than function result
new 223daaf Avoid integer overflows in fits_in_pe macro (issue #277)
new 497cd85 Stricter boundary checks in PE module
new 0f9d8a0 Fix minor style issues
new 71d43ec Fix issue with short-circuit evaluation
new 771fb59 Merge pull request #274 from hillu/symbols
new fc4696c Prepend yr_ prefix to min and max to avoid conflicts in C++ programs
new c53c083 Fix regression in pe_collect_resources().
new e45e6cb Merge pull request #284 from wxsBSD/resource_regression
new dc70062 Show warning for potentially slow loops
new e91f2e9 Revert "Show warning for potentially slow loops"
new 4aafc3e Fix bug where parsing (side effect in assert)
new 7b9b3d8 Merge pull request #285 from shanehuntley/parsefix
new 4fab384 Corrected NDEBUG version of assertf macro to have the same definition as the DEBUG version.
new eb0dd14 Included stdint.h for uint16_t, required for more strict compilers.
new 5ce0f3e Merge pull request #287 from orangetoaster/master
new 3a4ed03 Improve profiling
new c1b52ac Update writingmodules.rst
new 24e7f8d Merge pull request #289 from JusticeRage/patch-1
new e946414 Add yr_filemap_map_fd API
new 57e5e9d Add yr_rules_scan_fd API
new 29d7c62 Stop iterating on resources when resource tables are corrupt.
new 1cc98f7 also limit import numbers to prevent blowup
new 7f2ee48 Fixed midrule at $8 of 'rule' has no declared type
new e1f5436 Merge pull request #1 from michalmalik/michalmalik-patch-1
new 6e2d22f Added constants concerning program headers
new 2af8308 Merge pull request #2 from michalmalik/michalmalik-patch-2
new 5921ece Made program headers accessible from elf module
new 67cba93 Merge pull request #3 from michalmalik/michalmalik-patch-3
new 5c76ef7 Added PT_GNU_STACK
new fef2ecc Fix PRINT_MODULE_DATA.
new a6f609f Print non-printable characters in hex.
new a5c78e9 Fixed wrong version number (3.2.0) on Windows
new d771e5c Merge pull request #291 from shanehuntley/pememleak
new 810f175 Merge pull request #294 from wxsBSD/print_module_data_fix
new 92827d5 Simplify code and avoid exceeding the 80 characters per line limit
new 01fd0f6 PE module: avoid segfault after failed allocation.
new c19e83a Merge pull request #275 from kai5263499/master
new 3bbae40 Merge pull request #296 from hillu/crash
new afd2497 Minor style changes
new 4565007 Fix issues with PE files having a corrupt header with wrong number of sections
new 07d9d74 Add improvements suggested in pull request #282
new 78336a1 Implement -D (--print-module-info).
new c71eb11 s/SHOW_MODULE_INFO/SCAN_FLAGS_SHOW_MODULE_INFO/
new b01eeab PE module: avoid off-by-one leading to segfault
new 1e34c4c Merge pull request #299 from hillu/crash
new 7adc867 Removed from .gitignore file m4/acx_thread.m4, needed to compile
new 19b9648 Merge pull request #302 from plutec/master
new 3907a97 Merge pull request #298 from wxsBSD/module_data_option
new 5d5bb04 Minor style changes
new 922f1f9 Merge pull request #293 from michalmalik/master
new 85116f2 Mutex lock on is_loaded bitmask
new 14be846 Merge pull request #304 from shanehuntley/lock_fix
new 348dae6 Perform stream I/O tests without relying on a predefined compiled file
new d904634 Handle empty strings correctly (issue #303)
new ef05a68 Remove the "is_loaded" field from module entries to avoid multithreading issues.
new 9da6a85 Merge pull request #283 from hillu/scan-fd
new 7b3f5d1 Add YR_ prefix to FILE_DESCRIPTOR
new b8982db Add missing typecasts causing warnings in Visual C++
new f7353d8 Get rid of designated initializations as MS Visual C++ don't support it
new 865332e Add stream.c to Vistual Studio project
new 97c46f3 Fix issues in yara-python while compiling in Windows
new d11a682 Fix bug while writing to streams in Python 3.x
new 95c78d7 Add missing typecasts
new 8502393 Stricter file version check
new 24f7936 Use flex 2.5.39 to avoid calls to exit() from inside the parser (issues #267 and #272)
new ba6e9e4 Add Gitter's badge
new c84e2e9 Add osquery to list of projects using YARA.
new fd2826a PE module: avoid memory leak if there are no valid PKCS7 certs
new 9661cd5 Merge pull request #308 from hillu/master
new 2cd162f Merge pull request #307 from wxsBSD/osquery
new 420e8f5 Add x64dbg to list of projects using YARA
new 9c60ecb Get rid of nonsensical configure.ac line that was introduced in f81493e36b82dfa88682884d2036b14fdea6be41
new 63d1322 Added Heroku as a user
new 1ed8283 Optimize _yr_rules_clean_matches
new 0643f46 Fix bug introduced in previous commit
new decae6f Faster matches cleanup
new c979823 Merge pull request #312 from rhyselsmore/master
new 5f02d37 Fix bounds check for iterating over certificates
new a759589 Add thread index (tidx) to scan context
new 43f2ec9 Merge pull request #310 from hillu/master
new 6bec4f4 Missing close parenthesis
new 5ccd0b9 Merge pull request #313 from awick/patch-1
new 4cd0998 Add Hilko Bengen to AUTHORS and CONTRIBUTORS
new 3cb04bc Fix the ARM architecture value
new 1f018ff Add Linux et Mac files to .gitignore
new 5215859 Add more architectures to support
new 4fd4012 Fix bug while reading from streams in yara-python
new ee0069c Optimize mapped files for sequential access
new 0fe4b17 Add Raytheon to "Who's using YARA"
new 06f9e94 Fix memory leak
new 85456ae Homogenize style
new a13e780 Merge pull request #309 from nyx0/master
new 1e0bb3c Remove extra spaces
new 4576e51 Merge pull request #238 from dkiser/rpmspec
new dcce4d1 Update RPM spec
new fc704b6 Update documentation
new 2fe34e0 Make "save" and "load" methods more coherent with existing "match" and "compile"
new 8304634 Revert commit 9c60ecb2e2d11e136d31ccff155d833f4d3d9a1d
new 0e6f070 Implement non-greedy range quantifier in regular expressions
new 10da150 Fix an issue with certain regular expressions reporting matches longer than expected.
new 76de3a7 Better atom extraction when using {n,m} quantifiers
new 9802ee6 More test cases for regular expressions
new 9a5b759 Update yara-python documentation
new 79b953c Add missing typecast
new e67d00a Include gcc-specific pragma only when compiling with gcc
new c9ee8fc Rename some ELF segment's fields to match naming convention used in PE module
new e6604b6 Add missing #endif directive
new de462ae Remove unused variable
new a0d44da Add Koodous to "who's using YARA"
new 7a4f9f5 Fix issue #319
new ca4c2e2 Update documentation
new af4daff Update documentation
new 5686c6b Improve printing layout for yr_object_print_data
new 62f8670 Change --print-module-info to --print-module-data
new a96846f Document new command-line options
new a7a2319 Avoid warning due to unused variable when profiling is disabled
new 406fda8 Fix warnings
new 040db95 Set version number to 3.4.0
The 702 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "adds" were already present in the repository and have only
been added to this reference.
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/forensics/yara.git
More information about the forensics-changes
mailing list