-
-
Notifications
You must be signed in to change notification settings - Fork 352
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Rust API: Yara Match Rules are truncated #292
Comments
As you noted I put the limit to 8. I'll look into increasing it. But currently there is a fixed struct buffer for that and I had another guy that wanted me to raise the limit of the number of yara findings to more than 65k. I think he wanted to scan potentially millions of hits. And all this eats memory in the worst case scenario. I'll see what I can do though. But since there is an API change involved (even if minor) it will have to wait until the 5.10 release when that happens. I don't have a strict plan for it, but maybe in a few months time; or at the very least when I've finished support for Win11 24H2 / Server2025. I'll put this up as an enhancement request for now. I'll definitely look into raising the limit. |
I do not see where the "fixed struct buffer" comes into play. |
It's not an issue with the Rust API, rather the underlying C/C API. It's hard coded to max 8 values currently. Line 1932 in f99fe8e
|
Thanks for the info, I did not realize that there was a limit in the C interface as well. Since there is already a limit in C, why not remove (or significantly increase) the limits in Rust, where we now have
|
Thanks. I've messed up the number of meta tags in Rust. I'll increase it to 16 to match the C API. Even though you increased that value to 32 I suspect you'll max see 16 meta tags anyway due to the # of meta tags being in the cMeta DWORD anyway. |
Cool, thanks! |
I just published the 5.10 release. The yara matches are now seriously increased. There is still a limit though, but I hope it will be sufficient now. Please let me know if you should still run into issues around it. |
The struct VmmYaraMatch includes several vectors:
However, it seems that not all items from the Yara rule or result are included.
impl_yara_cb seems to truncate those vectors to only 8 values:
May I suggest to increase this to at least 32, or even better: make it configurable when calling the API.
The text was updated successfully, but these errors were encountered: