YARA v3.8.0
- Scanner API.
- New “xor” modifier for strings.
- New fields and functions in PE module.
- Add functions “min” and “max” to math module.
- Make compiled.
yara
andyarac
support reading rules from stdin by using-
as the file name.- Rule compilation is faster.
- BUGFIX: Regression in regex engine. /ba{3}b/ was matching “baaaab”.
- BUGFIX: Function yr_compiler_add_fd() was reading only the first 1024 bytes of the file.
- BUGFIX: Wrong calculation of sha256 hashes in Windows when using native crypto API.
- Lots of more bug fixes.
Refer to the documentation for information on how to build and install YARA.