Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
c812241
feat: introduce `ModuleContext` for YARA modules
plusvic Jun 18, 2026
9502813
style: run `cargo fmt`.
plusvic Jun 18, 2026
e050078
feat: introduce 'zip' module for inspecting ZIP archives
plusvic Jun 18, 2026
aeb8cfe
chore(deps-dev): bump undici from 7.24.1 to 7.28.0 in /ls/editors/cod…
dependabot[bot] Jun 18, 2026
3d0f60f
feat: implement `olecf` and `vba` modules. (#688)
plusvic Jun 22, 2026
dfaa4e1
fix: don't derive header constraints from patterns with byte-transfor…
nugxperience Jun 23, 2026
0b14069
feat(pe): add missing machine architecture types (#687)
cherepanov74 Jun 23, 2026
b2e0fca
chore: assert completeness of pattern flags for header constraints
plusvic Jun 23, 2026
71baa67
feat: flag single-byte patterns as slow and allow failing compilation
plusvic Jun 23, 2026
3f2b2aa
chore: upgrade dependencies.
plusvic Jun 23, 2026
496b5c8
style: remove empty lines.
plusvic Jun 23, 2026
4fbaf55
docs: add documentation for `Rules::header_constraints`.
plusvic Jun 24, 2026
25efa37
fix: prevent undefined behavior when deserializing rules from untrust…
plusvic Jun 24, 2026
f7d6a43
chore: don't include `vba` and `olecf` as default modules.
plusvic Jun 24, 2026
4426f0a
chore: bump version to 1.19.0.
plusvic Jun 24, 2026
dc48090
chore: fix test cases after disabling `vba` and `olecf` modules.
plusvic Jun 24, 2026
fe40349
tests: ignore disabled modules while running tests.
plusvic Jun 24, 2026
3935336
tests: add multiple test cases for increasing code coverage.
plusvic Jun 24, 2026
a3911cf
style: run `cargo fmt`.
plusvic Jun 24, 2026
9338b86
tests: add more test cases for increasing parser coverage.
plusvic Jun 24, 2026
6374b65
style: fix clippy warning.
plusvic Jun 24, 2026
795588e
tests: increase coverage for parser and hoisting logic.
plusvic Jun 24, 2026
b276318
tests: more test cases for better coverage.
plusvic Jun 24, 2026
1c78808
chore: remove file accidentally committed.
plusvic Jun 24, 2026
85757fd
Merge upstream commit '1c788083' into sync/upstream-1c788083
willdurand Jun 29, 2026
949330c
Update AMO module signature to use the new ModuleContext param
willdurand Jun 29, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
83 changes: 60 additions & 23 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

18 changes: 11 additions & 7 deletions Cargo.toml
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
[workspace.package]
version = "1.18.0"
version = "1.19.0"
authors = ["Victor M. Alvarez <vmalvarez@virustotal.com>"]
edition = "2024"
homepage = "https://virustotal.github.io/yara-x"
Expand Down Expand Up @@ -39,20 +39,23 @@ ascii_tree = "0.1.1"
base64 = "0.22.1"
bincode = "2.0.1"
bitflags = "2.13.0"
bitvec = "1.0.1"
bitvec = "1.1.1"
bstr = "1.12.1"
cbindgen = "0.29.4"
chrono = "0.4.45"
clap = "4.6.1"
clap_complete = "4.6.5"
codepage = "0.1.2"
const-oid = "0.9.6"
crc32fast = "1.5.0"
der-parser = "10.0.0"
digest = "0.10.7"
dsa = "0.6.3"
ecdsa = "0.16.9"
encoding_rs = "0.8"
env_logger = "0.11.10"
figment = "0.10.19"
flate2 = "1.1.5"
globwalk = "0.9.1"
goldenfile = "1.11.0"
getrandom = "0.2.17"
Expand Down Expand Up @@ -107,12 +110,13 @@ wasm-opt = "0.116.1"
wasmtime = { version = "43.0.2", default-features = false }
x509-parser = "0.18.0"
yansi = "1.0.1"
yara-x = { path = "lib", version = "1.18.0" }
yara-x-fmt = { path = "fmt", version = "1.18.0" }
yara-x-macros = { path = "macros", version = "1.18.0" }
yara-x-parser = { path = "parser", version = "1.18.0" }
yara-x-proto = { path = "proto", version = "1.18.0"}
yara-x = { path = "lib", version = "1.19.0" }
yara-x-fmt = { path = "fmt", version = "1.19.0" }
yara-x-macros = { path = "macros", version = "1.19.0" }
yara-x-parser = { path = "parser", version = "1.19.0" }
yara-x-proto = { path = "proto", version = "1.19.0"}
zip = { version = "8.2.0", default-features = false }
tinyzip = "0.4.0"
simd-adler32 = "0.3.9"
simd_cesu8 = "1.1.1"
assert-call = "0.1.2"
Expand Down
2 changes: 1 addition & 1 deletion cli/Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ anyhow = { workspace = true }
ascii_tree = { workspace = true }
clap = { workspace = true, features = ["cargo", "derive"] }
clap_complete = { workspace = true }
encoding_rs = { workspace = true }
figment = { workspace = true, features = ["toml"] }
globwalk = { workspace = true }
home = { workspace = true }
Expand All @@ -75,7 +76,6 @@ chardetng = "1.0.0"
crossbeam = "0.8.4"
crossterm = "0.29.0"
dunce = "1.0.5"
encoding_rs = "0.8.35"
indicatif = "0.18.4"
unicode-width = "0.2.2"
wild = "2.2.1"
Expand Down
14 changes: 14 additions & 0 deletions cli/src/commands/dump.rs
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@ enum SupportedModules {
Elf,
Pe,
Dotnet,
Olecf,
Vba,
Crx,
Dex,
}
Expand Down Expand Up @@ -119,6 +121,12 @@ pub fn exec_dump(args: &ArgMatches) -> anyhow::Result<()> {
if !requested_modules.contains(&&SupportedModules::Dex) {
module_output.dex = MessageField::none()
}
if !requested_modules.contains(&&SupportedModules::Olecf) {
module_output.olecf = MessageField::none()
}
if !requested_modules.contains(&&SupportedModules::Vba) {
module_output.vba = MessageField::none()
}
} else {
// Module was not specified, only show those that produced meaningful
// results, the rest are cleared out.
Expand All @@ -145,6 +153,12 @@ pub fn exec_dump(args: &ArgMatches) -> anyhow::Result<()> {
if !module_output.dex.is_dex() {
module_output.dex = MessageField::none()
}
if !module_output.olecf.is_olecf() {
module_output.olecf = MessageField::none()
}
if !module_output.vba.has_macros() {
module_output.vba = MessageField::none()
}
}

match output_format {
Expand Down
Loading