Update to Yara 4.3

[vthib]

This is a work in progress, as Yara 4.3 is not out yet.

Most of the small work has been done, what's left is:

• Add tlsh & md5 hash in elf module (Integrate tlshc library, calculate telfhash and import hash in ELF module VirusTotal/yara#1624)
• Add authenticode parsing in pe module (Process Authenticode signatures using authenticode-parser VirusTotal/yara#1623)
• Add new warnings (Add warnings for edge cases. VirusTotal/yara#1806) will not do
  • Needs a warning system, not yet done in boreal
• Add xor key flag in boreal-cli (XOR Values. VirusTotal/yara#1745)
• Add module names flag in boreal-cli ? (Print module names. VirusTotal/yara#1801)
• Realignment on SectionAlignment in pe module, see Fix pe_rva_to_offset VirusTotal/yara#1561

[plusvic]

@vthib, by following a link in YARA's repository I landed here and discovered this project. I don't know if you have seen https://github.com/VirusTotal/yara-x, but the goals are very similar: a complete implementation of YARA in Rust, that solves some of the pain points experienced by YARA users (like slow rules that should be actually fast) and developers (like the parser tightly coupled with YARA itself that disallows its reuse).

The approach however is different. YARA-X converts rule conditions into WebAssembly code, that in turns gets translated into native code. This makes conditions that rely heavily on loops much faster. The goal is that condition evaluation is 10x faster than the existing YARA on average. I see that you seem to have experience in Rust (more than myself, I'm gradually learning Rust with the YARA-X project), so if you would like to contribute to YARA-X in some way you are really welcomed. The project is still immature and unstable, but I've made a lot of progress already, and have implemented most of the condition evaluation logic.

[vthib]

So this is failing only on linux32, and it took me longer than expected to understand why. Running boreal-cli has no issues, running the tests on linux32 does give invalid values for not_before and not_after fields in the authenticode certificates.
Turns out, this is a linker issue. When linking the final binary, there are two libraries that have functions with the same names:

• libyara.a version 4.3, compiled through yara-rust, with the new authenticode library
• libauthenticode.a, compiled through the authenticode-parser crate, with this authenticode library as well.

So the linker can pick any of those two and we can't control it.

• For boreal-cli, this is not an issue, we do not link against yara, so there is a single solution.
• For the tests, we link against yara to check conformance, hence the conflict. This is all fine if both libraries have the same code, but because of this commit: vthib/authenticode-parser-1@fd91356, the objects do not have the same size. We end up linking against the yara authenticode functions, but use the bindings on the authenticode-parser version. Those types differ only on linux32 (time_t = 32 bits != int64_t), causing the crashes.

Best solutions is probably to rename all of the functions in the authenticode-parser crate to avoid conflicting with yara symbols... Fun.