fatal error: unexpected signal during runtime execution about go-yara

[hillu]

Hi @altsab.

the keepAlive function is a simple wrapper around runtime.KeepAlive which allows the go-yara codebase to be compiled using pre-1.7 Go. It could probably be replaced by runtime.KeepAlive at this point...

Can you share a minimal setup (code + rule + matching sample) to reproduce the crash? Thank you!

[unstppbl]

runtime.KeepAlive does the work, thank you!

Here is the files and code.

Error stack : error.txt
Matching sample: shell.zip
Rule: thor-webshells.zip

Code:

package main

import (
	"encoding/json"
	"os"
	"path/filepath"
	"time"

	log "github.com/Sirupsen/logrus"
	yara "github.com/hillu/go-yara"
)

const (
	rulesDir = "rules"
)

var (
	compiler      *yara.Compiler
	blacklisted   []string
	compiledRules *yara.Rules
)

func main() {
	matches, err := scanFile("wso2.php", 60)
	if err != nil {
		panic(err)
	}
	j, err := json.Marshal(matches)
	if err != nil {
		panic(err)
	}
	log.Infof("[*] Matches: %s", string(j))
}

// StringInSlice returns whether or not a string exists in a slice
func StringInSlice(a string, list []string) bool {
	for _, b := range list {
		if b == a {
			return true
		}
	}
	return false
}

// compileRules compiles the yara rules
func compileRules() error {
	log.Info("[*] In compileRules")
	fileList := []string{}

	// walk rules directory
	err := filepath.Walk(rulesDir, func(path string, f os.FileInfo, err error) error {
		if !f.IsDir() {
			fileList = append(fileList, path)
		}
		return nil
	})
	if err != nil {
		return err
	}

	// new yara compiler
	compiler, err = yara.NewCompiler()
	if err != nil {
		return err
	}

	// compile all yara rules
	for _, file := range fileList {
		log.Infof("[*] Adding rule %s", file)
		if StringInSlice(file, blacklisted) {
			continue
		}

		f, err := os.Open(file)
		if err != nil {
			return err
		}

		log.Debug("Adding rule: ", file)
		err = compiler.AddFile(f, "webtotem")
		if err != nil {
			blacklisted = append(blacklisted, file)
			for _, er := range compiler.Errors {
				log.WithFields(log.Fields{
					"rule":    er.Filename,
					"line_no": er.Line,
				}).Error(er.Text)
			}
			f.Close()

			// destroy unstable YR_COMPILER
			// (see https://github.com/hillu/go-yara/issues/32#issuecomment-416040753)
			log.Debug("destroying unstable yara compiler")
			compiler.Destroy()
			log.Debug("recreating yara compiler")
			os.Exit(1)
			if err := compileRules(); err != nil {
				log.Fatal(err)
			}
		}
		f.Close()
	}

	return nil
}

func scanFile(path string, timeout int) ([]yara.MatchRule, error) {
	log.Info("[*] In scanFile")
	// comile rules if they haven't been compiled yet
	if compiler == nil {
		log.Info("[*] Compiling rules (called from scanner)")
		if err := compileRules(); err != nil {
			log.Fatal(err)
		}
	}

	if compiledRules == nil {
		log.Info("[*] Getting rules (called from scanner)")
		r, err := compiler.GetRules()
		if err != nil {
			return nil, err
		}
		compiledRules = r
	}

	matches, err := compiledRules.ScanFile(
		path, // filename string
		0,    // flags ScanFlags
		time.Duration(timeout)*time.Second, //timeout time.Duration
	)
	log.Infof("[*] After scan, matches length: %d", len(matches))

	if err != nil {
		return nil, err
	}

	return matches, nil
}

[hillu]

What Go version were you using?

[unstppbl]

go version go1.10.3 linux/amd64

[hillu]

@altsab Sorry, I cannot reproduce your crash with the sources built using go version go1.10.3 linux/amd64 (Debian/unstable) from yara 3.8.1 (Debian package from unstable) and go-yara commit 54bec3c.

Were you scanning more than one file?

[unstppbl]

Yup, I scanned several including wso shell 🤔
Here they are
test.zip

[hillu]

Does the test program you posted actually crash when scanning the wso2.php shell? I really can't reproduce that crash at all. (Using go-yara commit 0540979 unlike stated above.)

[hillu]

@altsab Can you give me a self-contained program that reproduces your crash? Something that does not rely on anything but the Go stdlib and go-yara would be preferred.

[unstppbl]

@hillu sorry for the late reply, I just tried to reproduce the crash but I couldn't either. Dunno what changed 🤔
Seems like it was something to do with my setup or environment.