On Fri, 25 Feb 2022, Laurent S. via clamav-users wrote:
I've had the same issue. In the last two years, I was regularly
writing YARA sigs in ClamAV and finding that it behaves in strange
ways... Especially the regex integration.
... ...
After too many timeouts and strange stuff, I decided to rewrite all
of the sigs I had written to LDB. It's not easy to read, less fun to
write... but damn it's much more reliable and fast.
Did you build any tools to help with your rewrite ?
If so they might be a good starting point for a YARA <-> LDB convertor,
which sounds like a useful project.
--
Andrew C. Aitchison Kendal, UK
and...@aitchison.me.uk
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
