Relative paths in include statements

[uggwar]

Hi!

Can't seem to load files that has include statements like this:

include "subdir/SomeGreatYaraRules.yar"

I load these files with err := compiler.AddFile(f, "ns")

[hillu]

Are you expecting the file to be found relative to the current working directory of your program? Or are you expecting it to be found relative to the directory in which the including file resides?

[uggwar]

Relative to where the including file resides. Usually I have subfolders with rules divided into files. At the top level there are yar-files that include certain files relative to its own location. Using yarac works fine, but compiler.AddFile panics saying that the relative path cannot be found.

[hillu]

Curious. I just ran into the problem you described today. Without having looked at the commit history, I'm pretty sure that this has to do with a behavior change in libyara. I'll have to investigate further…

[hillu]

I just created a.yar containing the following two lines:

include "b.yar"
include "subdir/c.yar"

Both included files exist and are empty.

I can compile this using yarac from both YARA 3.11 and current master (commit b534f03eecd8a109db2b085ab24d419b6486de97), also with the following little Go test program built with Go 1.13.5 (Linux/amd64) against either version:

package main

import (
	"github.com/hillu/go-yara"

	"log"
	"os"
)

func main() {
	c, _ := yara.NewCompiler()
	f, _ := os.Open("a.yar")
	log.Printf("Using '%s'…", f.Name())
	if err := c.AddFile(f, ""); err != nil {
		log.Fatalf("addfile: %v", err)
	}
	if _, err := c.GetRules(); err != nil {
		log.Fatalf("compile: %v", err)
	}
	log.Print("Done.")
}

[hillu]

@uggwar The problem you encountered may have to do with your ruleset resulting in multiple errors: When I try to compile index.yar from https://github.com/Yara-Rules/rules with yarac from a YARA build without Cuckoo support, this results in a number of error messages:

./malware/MALW_AZORULT.yar(5): error: unknown module "cuckoo"
./malware/MALW_AZORULT.yar(23): error: invalid field name "sync"
./malware/MALW_AZORULT.yar(167): error: can't open include file: ./malware/MALW_AgentTesla.yar
./malware/MALW_AZORULT.yar(168): error: can't open include file: ./malware/MALW_AgentTesla_SMTP.yar
./malware/MALW_AZORULT.yar(169): error: can't open include file: ./malware/MALW_AlMashreq.yar
[…]
./malware/MALW_AZORULT.yar(443): error: can't open include file: ./malware/TOOLKIT_THOR_HackTools.yar
./malware/MALW_AZORULT.yar(444): error: can't open include file: ./malware/TOOLKIT_Wineggdrop.yar
./malware/MALW_AZORULT.yar(445): error: can't open include file: ./malware/TOOLKIT_exe2hex_payload.yar

(I am pretty sure that all the "cannot open include file" messages are symptoms of a bug within YARA itself.)

Now, when I use my test program to compile this rule, I only get the following message:

addfile: can't open include file: ./malware/TOOLKIT_exe2hex_payload.yar

This is only the last error reported by YARA. However, all the warnings and errors are stored in (*Compiler).Warnings and (*Compiler).Errors, respectively.

[hillu]

@uggwar Ping? Do you think that my analysis is correct?

[uggwar]

Sorry for the late reply. Yes, this sounds very plausible, since I've built yara without most dependencies. I will have a look tomorrow! Thanks for the help! Christer

…

On Tue, 7 Jan 2020, 19:34 Hilko Bengen, ***@***.***> wrote: @uggwar <https://github.com/uggwar> Ping? Do you think that my analysis is correct? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#56?email_source=notifications&email_token=ABJ2H6WEVKTYJO2QREQ76QLQ4TDKBA5CNFSM4JZNLKVKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEIJ2R5I#issuecomment-571713781>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABJ2H6VZD6RQEK7Q5W2FUG3Q4TDKBANCNFSM4JZNLKVA> .