Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use the SCAN_FLAGS_NO_TRYCATCH flag when invoking YARA from ScanMem #137

Merged
merged 3 commits into from
Nov 29, 2023

Commits on Nov 8, 2023

  1. Enhance the Error type to provide more information about the error.

    This introduces the following changes.:
    
    * The `Error` code now has a `Code` field that exposes the YARA API error code to Go users, and also exposes the error codes as constants that can be used in Go code (example: `err.Code == yara.ERROR_TIMEOUT`). Sometimes is useful to get a numeric error code instead of a text string.
    
    * When `Error` is converted to a string, it includes the name of the rule causing the error. For example, instead of getting an error like `syntax error, unexpected identifier, expecting <condition>`, you get `rule \"foo\": syntax error, unexpected identifier, expecting <condition>`.
    plusvic committed Nov 8, 2023
    Configuration menu
    Copy the full SHA
    a42cf8d View commit details
    Browse the repository at this point in the history

Commits on Nov 27, 2023

  1. Configuration menu
    Copy the full SHA
    52434f0 View commit details
    Browse the repository at this point in the history
  2. Use the SCAN_FLAGS_NO_TRYCATCH flag when invoking YARA from ScanMem

    By default YARA installs an exception handler that captures SIGBUS and SIGSEGV signals during the time a scan is active. This has the purpose of capturing signals that can occur while reading from memory mapped files. However, this is a process-wide exception handler that seems to interfere with Golang's ability to detect null pointer accesses and produce memory dumps.
    
    We have seen in production cases in which a Golang process that uses YARA enters an state in which the process does nothing but doesn't crash. We suspect it is somewhat related to the exception handler installed by YARA.
    
    As a temporary measure this patch disables the installation of the exception handler during calls to `ScanMem`. Installing such handler doesn't make sense while scanning memory that is not backed by a mmaped filed.
    plusvic committed Nov 27, 2023
    Configuration menu
    Copy the full SHA
    26ddefc View commit details
    Browse the repository at this point in the history