{"id":8679,"date":"2025-11-24T04:03:40","date_gmt":"2025-11-24T04:03:40","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/11\/24\/32514\/"},"modified":"2025-11-24T04:03:40","modified_gmt":"2025-11-24T04:03:40","slug":"32514","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/11\/24\/32514\/","title":{"rendered":"YARA-X 1.10.0 Release: Fix Warnings, (Sun, Nov 23rd)"},"content":{"rendered":"<p>    YARA-X 1.10.0 Release: Fix Warnings, (Sun, Nov 23rd)<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n    <!-- no image --><br \/>\n \t<BR><br \/>\n<BR><\/BR><\/p>\n<div>\n<p><a href=\"https:\/\/github.com\/VirusTotal\/yara-x\/releases\/tag\/v1.10.0\">YARA-X&#8217;s 1.10.0<\/a> release brings a new command: fix warnings.<\/p>\n<p>If you have a rule that would generate a warning with a help section (explaining how to fix it), like this example rule:<\/p>\n<p>\u00a0<\/p>\n<pre>\n<code>rule FixableCountWarning\n{\n    strings:\n        $a1 = \"malicious\"\n        $a2 = \"badstuff\"\n\n    condition:\n        0 of ($a*)\n}\n<\/code><\/pre>\n<p><img data-recalc-dims=\"1\" decoding=\"async\" alt=\"\" src=\"https:\/\/i0.wp.com\/isc.sans.edu\/diaryimages\/images\/20251123-110201.png?ssl=1\" style=\"width: 819px; height: 293px;\"><\/p>\n<p>Then YARA-X from version 1.10.0 on can fix this for you<\/p>\n<p>You will get a warning when you use this rule:<\/p>\n<p><img data-recalc-dims=\"1\" decoding=\"async\" alt=\"\" src=\"https:\/\/i0.wp.com\/isc.sans.edu\/diaryimages\/images\/20251123-110226.png?ssl=1\" style=\"width: 819px; height: 401px;\"><\/p>\n<p>The suggested fix is to replace 0 with none.<\/p>\n<p>This can be done automatically with command fix warnings:<\/p>\n<p><img data-recalc-dims=\"1\" decoding=\"async\" alt=\"\" src=\"https:\/\/i0.wp.com\/isc.sans.edu\/diaryimages\/images\/20251123-110255.png?ssl=1\" style=\"width: 819px; height: 327px;\"><\/p>\n<p>Remark that this command alters your original rule file, and doesn&#8217;t make a backup of the unaltered file:<\/p>\n<p><img data-recalc-dims=\"1\" decoding=\"async\" alt=\"\" src=\"https:\/\/i0.wp.com\/isc.sans.edu\/diaryimages\/images\/20251123-110323.png?ssl=1\" style=\"width: 819px; height: 281px;\"><\/p>\n<p>\u00a0<\/p>\n<p>\u00a0<\/p>\n<p>Didier Stevens<br \/>\nSenior handler<br \/>\n<a href=\"http:\/\/blog.didierstevens.com\/\">blog.DidierStevens.com<\/a><\/p>\n<p> (c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n<p> \t<BR><br \/>\n <BR><\/BR><\/p>\n<p> \t<BR><br \/>\n<BR><\/BR><br \/>\n<a href=\"https:\/\/isc.sans.edu\/diary\/rss\/32514\">Go to isc.sans.edu<\/a><br \/>\n \t<BR><br \/>\n <BR><\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"<p>YARA-X 1.10.0 Release: Fix Warnings, (Sun, Nov 23rd) YARA-X&#8217;s 1.10.0 release brings a new command: fix warnings. If you have a rule that would generate a warning with a help section (explaining how to fix it), like this example rule: \u00a0 rule FixableCountWarning { strings: $a1 = &#8220;malicious&#8221; $a2 = &#8220;badstuff&#8221; condition: 0 of ($a*) [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[56],"tags":[69],"class_list":["post-8679","post","type-post","status-publish","format-standard","hentry","category-isc-sans-edu","tag-isc-sans-edu"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/8679"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=8679"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/8679\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=8679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=8679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=8679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}