System.AccessViolationException in yr_compiler_create

[admiralbenbou]

System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
at yr_compiler_create(_YR_COMPILER** )
at libyaraNET.Compiler..ctor()
at libyaraNET.Compiler.CompileRulesFile(String path)
at libyaraNET.QuickScan.Memory(IntPtr buffer, Int32 length, String rulesPath, ScanFlags flags)
at libyaraNET.QuickScan.Memory(Byte[] buffer, String rulesPath, ScanFlags flags)

LibyaraNet version 4.0.2

[swannman]

@admiralbenbou could you please share sample code and a Yara rule that demonstrates this issue? Thanks!

[admiralbenbou]

Hello. Sure, office.txt
var stopwatch = new Stopwatch(); stopwatch.Start(); try{ List<ScanResult> scanResults = QuickScan.Memory(buffer, rulesPath, ScanFlags.Fast ); stopwatch.Stop(); if (scanResults.Any()) return true; return false; }

[admiralbenbou]

may be important. this method is used in a multi-threaded application - a transport agent for exchange. and an exception does not occur immediately - only after processing several emails (several method calls)

[shaheeraliwrg]

@swannman I'm experiencing the same issue, is there any update?

[admiralbenbou]

@swannman I'm experiencing the same issue, is there any update?

i asked my colleagues - c developers to make for me fixed version and i use it now https://github.com/k-sec-tools/ExchangeFilter/tree/main/libyaranet. but our version is few commits behind the official repo

[shaheeraliwrg]

@admiralbenbou That's fantastic! Could you tell me which version of Yara was used? Current version is 4.1.3 please check this link for reference.

[admiralbenbou]

@shaheeraliwrg not sure, it was 3.8.0 or 3.8.1. Be careful cause in yarav4.* API has been changed

[shaheeraliwrg]

Thanks for sharing this, it's really helpful @admiralbenbou

[swannman]

@admiralbenbou would you be open to creating a pull request so we can merge your changes into this repro?

[admiralbenbou]

@swannman dont think it will make sense. my colleagues just fixed libyara v3.7.x code(bcause the main bug was in this librara) and rebuilt libyaraNET with it. and because libyara v3 is not actual version, i dont think we have to pull this changes to main libyara repo

[shaheeraliwrg]

@swannman How can we upgrade libyara.net's YARA version? Does there exist any documentation or guideline to do this? I would like to upgrade the YARA version to the latest, as it may solve the issues listed above. Can you please help me upgrade the version?

[swannman]

@shaheeraliwrg libyara.NET ships with YARA 4.0.2 today. We consume YARA from this nuget which we build from the vcpkg project here.

It looks like the latest version of YARA in vcpkg is 4.1.1. Is there a fix between 4.0.2 and 4.1.1 for the issue that you were seeing?

[shaheeraliwrg]

@swannman I'm not sure if this issue has been fixed in the latest Yara version. But if possible we should go with the latest version (there are tons of fixes in the latest version). I tried upgrading the libyara.Net with the latest yara version, but I wasn't able to finish due to the lack of documentation.

[gnh1201]

The version is libyara.NET 4.5.1, targeting x86, and the runtime is .NET Framework 4.8.

System.AccessViolationException
    at yr_rules_scan_fd(YR_RULES* , Void* , Int32 , IntPtr , Void* , Int32 )
    at libyaraNET.Scanner.ScanFile(String path, Rules rules, ScanFlags flags)
    at (My Application)

I used the official example rule: https://yara.readthedocs.io/en/stable/writingrules.html

rule ExampleRule
{
    strings:
        $my_text_string = "text here"
        $my_hex_string = { E2 34 A1 C8 23 FB }

    condition:
        $my_text_string or $my_hex_string
}