Recent versions of YARA accept a single rules file. I've updated the man page for further releases.
On Tue, Dec 22, 2015 at 11:02 PM, Rd Mustang <rdmust...@gmail.com> wrote: > I'm trying to write an application that runs yara rules using all the > rules in a directory. I've done this many times on yara 1.6 - 2.0 but on > 3.4 it's giving an error. > > $ ls ./yara/ > file1.yara file2.yara file3.yara > $ yara ./yara/ /tmp > ./yara/(1): error: input in flex scanner failed > > > It's not a file permissions thing. The rules are valid if run individually > or if combined into 1 file. I've tried multiple systems all with 3.4. Is > this a bug? This syntax is still listed in the current man page. > > I get an error with this (also listed in the man page): > > $ cat ./yara/* | yara -r /tmp > yara: wrong number of arguments > Usage: yara [OPTION]... RULES_FILE FILE | DIR | PID > > Try `--help` for more options > > > Any help is greatly appreciated. > > -- > You received this message because you are subscribed to the Google Groups > "YARA" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to yara-project+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "YARA" group. To unsubscribe from this group and stop receiving emails from it, send an email to yara-project+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
