Skip to content

Fixes for the ClamAV Yara generator - #67

Merged
JusticeRage merged 6 commits into
JusticeRage:masterfrom
ThatVoidUpdate:ClamAVGenerator
Jul 22, 2026
Merged

JusticeRage merged 6 commits into
JusticeRage:masterfrom
ThatVoidUpdate:ClamAVGenerator

Conversation

@ThatVoidUpdate

Copy link
Copy Markdown

Some ClamAV rules were not parsing properly, causing any scans using the ClamAV plugin to fail, as the rules could not be compiled. This PR specifically fixes 4 cases that were preventing compilation as of 22/07

  • ClamAV PCRE subsignatures could not be parsed. I've made them fail processing, but my fix could be modified in the future to actually implement the rules correctly, however it would mean rewriting the condition based on the rule. Fixes the first part of Could not compile yara rules #40.
  • One rule has a condition starting with 0:0, which makes no sense according to all documentation I can find. if the 0: is stripped off, the rule makes sense and compiles, so I added a detection for conditions that contain a ":", and only use the second part. Fixes the second part of Could not compile yara rules #40.
  • One rule has a condition that does not contain every single subsignature, which yara fails on. Added a check to make sure that a condition has every numbered subsignature from 0 to the max number, and fails the rule if it doesn't.
  • One rule has a subsignature which contains an alternate group with no alternate "(2526|)". As far as I can tell, ending an alternate group with a "|" is invalid, so rules matching that will be dropped.

I also added a -q/--quiet flag to both scripts, which suppresses the "Rule seems to be malformed" and "Unable to translate a logical signature" messages, as they made it hard to find debug information relevant to the bugs I was trying to fix

After adding these fixes, I can successfully process one of my own files using the ClamAV plugin with no false positives, however I do not have any malware to hand to make sure there are no false negatives.

@ThatVoidUpdate

Copy link
Copy Markdown
Author

Also the contributing guidelines https://docs.manalyzer.org/en/latest/before-contributing.html contain a style guide for the C++ part of the project, but nothing for the python side. I tried to emulate the existing style as much as I could

@JusticeRage

Copy link
Copy Markdown
Owner

Thanks a lot for these fixes!

@JusticeRage
JusticeRage merged commit 83b8b4f into JusticeRage:master Jul 22, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants