Jump to content

YARA YARA v4.3.0-rc1


Recommended Posts

  • Added a not operator for bytes in hex strings. Example: {01 ~02 03} (#1676).
  • for statement can iterate over sets of literal strings (e.g. for any s in ("a", "b"): (pe.imphash() == s)) (#1787).
  • of statement can be used with at (e.g. any of them at 0) (#1790).
  • Added the --print-xor-key (-X in short form) command-line option that prints the XOR key for xored strings (#1745).
  • Implement the --skip-larger command-line option in Windows (#1678).
  • Add parsing of .NET user types from .NET metadata stream in "dotnet" module (#1605).
  • Improve certificate parsing and validation in "pe" module (#1623).
  • Add telfhash() function to "elf" module (#1624).
  • Add to_int() and to_string() functions to "math" module (#1767).
  • Improve error reporting on certain edge cases (#1709, #1722).
  • BUGFIX: Fix multiple memory alignment issues causing crashes in non-x86 platforms (#1724).
  • BUGFIX: Fix implementation of math.serial_correlation(#1771).
  • BUGFIX: Fix infinite recursion in dotnet module (#1794).
  • BUGFIX: Fix SIGFPE when dividing INT64_MIN by -1.

Thanks to @shanehuntley, @1ndahous3, @HoundThe, @wxsBSD, @vthib


Link to comment
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...