The storage control block address is invalid. about go-yara HOT 5 CLOSED

@Greatnest The error message "The storage control block address is invalid" is produced by a Windows API, most likely when opening the rule file.
Can you provide a minimal reproducer (including instructions on how to compile your test program)?
Does everything work if you read the rules file into a buffer and pass that to (*Compiler).AddString?

from go-yara.

@hillu I followed mcastilho's Issue #7 instructions for compiling for Windows x64. I then installed TDM-GCC and copied the built libyara.a as the library to be used under C:\TDM-GCC-64\x86_64-w64-mingw32\lib. I then use your simple-yara.go example as the starting script.

The command I ran was go run simple-yara.go -rule yara.yar test.go. test.go is the file I want to run the yara rules on. I would get the same error when I ran go build simple-yara.go and running the binary using the same arguments. I am able to os.Open the file and read in contents of the file normally, it is during the c.AddFile(f, "namespace") that it errors.

(*Compiler).AddString works for me when I add the individual rule that is read from the file. If (*Compiler).AddString only reads a single rule at time, it would mean that I have to parse and extract each individual rule from the a file containing multiple rules correct?

from go-yara.

@Greatnest Please check if commit 2dbfae3 on branch compiler_addfile_split fixes the problem for you. (You need to use YARA 3.6 or newer for the changes in this commit to have any effect.)

from go-yara.

@hillu okay, based on my testings, the commit seems to be working fine for both AddString and AddFile and your example script works as intended.

Thanks for the help!

from go-yara.

Alright, then the commit is going into master. Thank you @Greatnest!

from go-yara.