yr_scanner_scan_file(m_pScanner, in_FilePath) returning 3

[Rajasekher]

We are using Yara.4.5.1 and we created a C++ wrapper around to access YARA apis. I'm calling yr_scanner_scan_file(m_pScanner, in_FilePath) method by passing in below kind of files:

But I received a 3 for all the below file scans. Would like to know what that means.

_דעה פוד.txt
EFS file.txt

[Rajasekher]

Any opinions please?

[plusvic]

It means ERROR_COULD_NOT_OPEN_FILE.

https://github.com/VirusTotal/yara/blob/548ba3d9c860e7b6c7286cbcf1f7e429cffe99f4/libyara/include/yara/error.h#L49C9-L49C34

[Rajasekher]

Thanks @plusvic. But any reason why it could not open the file? I understand with the "EFS File.txt" as it is encrypted but what about the other file I attached which is just a text file? Is it because of the name of the file(which has a different language)?

[plusvic]

Yes the API has issues with unicode characters in the path, but you can use yr_scanner_scan_fd as an alternative. This function receives a file handle that you can obtain using the CreateFile Windows API.