Hi Jonathan, yara-python uses YARA's C library under the hood, so you should get the same errors in both of them, unless you are using different versions. So the first thing you should do is making sure that you are using the latest version for both the C library and yara-python.
Regards, Víctor On Sun, May 19, 2019 at 7:50 AM Jonathan A <[email protected]> wrote: > Hi everyone, > > I'm using Yara's C API (can't use the Python one right now), and when > there's a long string of hex bytes (over approx. 10,000 characters) - I get > a compilation error like this: > > invalid hex string "$a0": string too long > > > The strange thing is that when I try compiling the same file with Python > (yara.compile(filepath)) - it works without a problem. So I tried looking > in the yara-python.c > <https://github.com/VirusTotal/yara-python/blob/master/yara-python.c> wrapper > to see how it handles these long strings, but I don't see any special > handling done there - it simply sends the file to compilation just like in > the C API... > > Any idea how is it that it works in Python and not in C? And of course - > is there any solution for the C API to not crash on these long strings? I > cannot change the yara rules themselves because they will be compiled > dynamically (i.e. I don't have all the files I want to compile in advance). > > Thanks! > > -- > You received this message because you are subscribed to the Google Groups > "YARA" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/yara-project/cd4c017e-3b8e-4f48-b897-cc195509c980%40googlegroups.com > <https://groups.google.com/d/msgid/yara-project/cd4c017e-3b8e-4f48-b897-cc195509c980%40googlegroups.com?utm_medium=email&utm_source=footer> > . > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "YARA" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/yara-project/CAD7Y4L5AYPh0WwgCymQFMmkZOvfKz7a%3D-w6oWDmK7S5Sr8SohA%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
