Re: How about importing yara into kernel space ?

[Wesley Shields]

If you are infected with a rootkit moving YARA into the kernel is not an answer 
since the rootkit has full access to muck around with YARA even if it is in the 
kernel.

My recommendation is don't run YARA on a system which is potentially 
compromised with a rootkit like you describe. If the kernel of the system is 
compromised you can no longer trust it.

Sure, it's possible to put YARA in the kernel but it isn't going to get you 
anything if your concern is rootkits.

-- WXS

> On Mar 18, 2016, at 1:19 AM, 慎增刘  wrote:
> 
> Yara is so powerful in malware matching. Sometimes people want to check files 
>  , which attached to file-systems hooks. So how about importing yara ( or 
> just libyara ) into linux kernel?  Is it possible? Is there some advices?  
> Thanks for each response.
> 
> -- 
> You received this message because you are subscribed to the Google Groups 
> "YARA" group.
> To unsubscribe from this group and stop receiving emails from it, send an 
> email to yara-project+unsubscr...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

-- 
You received this message because you are subscribed to the Google Groups 
"YARA" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to yara-project+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: Issue: Import Error undefined symbol: yr_finalize

[Steve Clement]

What I missed was that if you checkout from the git repo you have to 
initialize the submodule (yara)

git clone --recursive https://github.com/plusvic/yara-python


FYI.

On Wednesday, January 8, 2014 at 11:35:40 AM UTC+1, Stefan Molls wrote:
>
> That did the trick.
>
> - Did an: apt-get remove libyara0 (forgot to do this before)
> - Removed all remaining libyara files
> - Unpacked fresh yara-2.0.0 installation folder
>
> Now it works ... Thank you very much for your support!
>
> Am Mittwoch, 8. Januar 2014 04:06:13 UTC-6 schrieb Víctor Manuel Álvarez 
> García:
>>
>> Also remove the "build" folder inside yara-python, and do "python 
>> setup.py build" and "sudo python setup.py install" again.
>>
>>
>> On Wed, Jan 8, 2014 at 11:02 AM, Stefan Molls  wrote:
>>
>>> Yes I did use "root" rights to do the installation process. In addition 
>>> I deleted all libyara files under /usr/local/lib and reinstalled them 
>>> making sure I use the new version.
>>>
>>> Am Mittwoch, 8. Januar 2014 03:18:54 UTC-6 schrieb Víctor Manuel Álvarez 
>>> García:

 That sounds like you still have and old version of libyara in your 
 system. Did you did "sudo make install"?


 On Wed, Jan 8, 2014 at 9:35 AM, Stefan Molls  wrote:

> Hi all,
>
> I just tried to upgrade to yara 2.0 following the install instructions 
> on https://github.com/plusvic/yara/releases/tag/v2.0.0 .
>
> Whenever I try to import yara within python I receive the following 
> error:
>
>
>
>
>
>
>
>
>
> *Python 2.7.3 (default, Jan  2 2013, 16:53:07) [GCC 4.7.2] on 
> linux2Type "help", "copyright", "credits" or "license" for more 
> information. >>> import yaraTraceback (most recent call last):  File 
> "", line 1, in ImportError: 
> /usr/local/lib/python2.7/dist-packages/yara.so: undefined symbol: 
> yr_finalize *I am using Kali Linux (Linux workstation-k 
> 3.12-kali1-686-pae #1 SMP Debian 3.12.6-2kali1 (2014-01-06) i686 
> GNU/Linux). 
> Does anyone has an idea how I can fix this error?
>
> Thanks and best regards,
>  Stefan
>
> -- 
> You received this message because you are subscribed to the Google 
> Groups "YARA" group.
> To unsubscribe from this group and stop receiving emails from it, send 
> an email to yara-project...@googlegroups.com.
>
> For more options, visit https://groups.google.com/groups/opt_out.
>

 -- 
>>> You received this message because you are subscribed to the Google 
>>> Groups "YARA" group.
>>> To unsubscribe from this group and stop receiving emails from it, send 
>>> an email to yara-project...@googlegroups.com.
>>> For more options, visit https://groups.google.com/groups/opt_out.
>>>
>>
>>

-- 
You received this message because you are subscribed to the Google Groups 
"YARA" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to yara-project+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.