System.AccessViolationException in yr_compiler_create about libyara.net

[admiralbenbou]

Hello. Sure, office.txt
var stopwatch = new Stopwatch(); stopwatch.Start(); try{ List<ScanResult> scanResults = QuickScan.Memory(buffer, rulesPath, ScanFlags.Fast ); stopwatch.Stop(); if (scanResults.Any()) return true; return false; }

[shaheeraliwrg]

Thanks for sharing this, it's really helpful @admiralbenbou

[swannman]

@admiralbenbou could you please share sample code and a Yara rule that demonstrates this issue? Thanks!

[admiralbenbou]

may be important. this method is used in a multi-threaded application - a transport agent for exchange. and an exception does not occur immediately - only after processing several emails (several method calls)

[shaheeraliwrg]

@swannman I'm experiencing the same issue, is there any update?

[admiralbenbou]

@swannman I'm experiencing the same issue, is there any update?

i asked my colleagues - c developers to make for me fixed version and i use it now https://github.com/k-sec-tools/ExchangeFilter/tree/main/libyaranet. but our version is few commits behind the official repo

[shaheeraliwrg]

@admiralbenbou That's fantastic! Could you tell me which version of Yara was used? Current version is 4.1.3 please check this link for reference.

[admiralbenbou]

@shaheeraliwrg not sure, it was 3.8.0 or 3.8.1. Be careful cause in yarav4.* API has been changed

[swannman]

@admiralbenbou would you be open to creating a pull request so we can merge your changes into this repro?

[admiralbenbou]

@swannman dont think it will make sense. my colleagues just fixed libyara v3.7.x code(bcause the main bug was in this librara) and rebuilt libyaraNET with it. and because libyara v3 is not actual version, i dont think we have to pull this changes to main libyara repo

[shaheeraliwrg]

@swannman How can we upgrade libyara.net's YARA version? Does there exist any documentation or guideline to do this? I would like to upgrade the YARA version to the latest, as it may solve the issues listed above. Can you please help me upgrade the version?

[swannman]

@shaheeraliwrg libyara.NET ships with YARA 4.0.2 today. We consume YARA from this nuget which we build from the vcpkg project here.

It looks like the latest version of YARA in vcpkg is 4.1.1. Is there a fix between 4.0.2 and 4.1.1 for the issue that you were seeing?

[shaheeraliwrg]

@swannman I'm not sure if this issue has been fixed in the latest Yara version. But if possible we should go with the latest version (there are tons of fixes in the latest version). I tried upgrading the libyara.Net with the latest yara version, but I wasn't able to finish due to the lack of documentation.