Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Compilation of YARA rules during an incremental build fails with "error: unknown module dotnet" #760

Closed
s3rvac opened this issue May 3, 2020 · 1 comment

Comments

@s3rvac
Copy link
Member

s3rvac commented May 3, 2020

Compilation of YARA rules during an incremental build fails with error: unknown module "dotnet".

Steps to reproduce

For Linux, but the bug is platform-independent:

$ git clone https://github.com/avast/retdec
$ cd retdec
$ git checkout 8bcd65017faf195467a219f33ebc581623ae4652 # A commit prior to adding support for the dotnet module (#749).
$ mkdir build && cd build
$ cmake .. -DCMAKE_INSTALL_PREFIX=install
$ make -j$(nproc) && make install -j$(nproc)
$ git checkout master # Or any commit after adding support for the dotnet module (#749).
$ make -j$(nproc) && make install -j$(nproc)

Expected output

The incremental build and installation succeed.

Actual output

-- Up-to-date: yarac version '3.11.0'
-- Up-to-date: retdec/build/install/share/retdec/support (version is OK)
-- yarac version '3.11.0' written to 'retdec/build/install/share/retdec/support/version-yarac.txt'
-- Installing: retdec/build/install/share/retdec/support/generic/yara_patterns/tools/pe/x86/packers.yara
-- Compiling: retdec/build/install/share/retdec/support/generic/yara_patterns/tools/pe/x86/packers.yara
retdec/build/install/share/retdec/support/generic/yara_patterns/tools/pe/x86/packers.yara(7): error: unknown module "dotnet"
retdec/build/install/share/retdec/support/generic/yara_patterns/tools/pe/x86/packers.yara(115): error: invalid field name "number_of_user_strings"
Error: yarac failed during compilation of file retdec/build/install/share/retdec/support/generic/yara_patterns/tools/pe/x86/packers.yara

Probable cause and notes

Commit dfc58a6 (#749) added support for building YARA with the dotnet module. However, YARA (yarac) version was left unchanged. This made the build system believe that yarac does not need to be re-built when doing an incremental build. However, without re-building, the dotnet module is unavailable.

A workaround is to remove build/deps/yara, but this is annoying. Also, when someone stumbles upon this bug, they may wonder whether they are doing something wrong, or whether there is something wrong with RetDec. Last, but certainly not least, this bug will probably bite us again in the future.

My suggestion is to improve the build system so it detects changes in the build parameters and re-builds yarac when we change the build parameters. We could bump the version of YARA, but this feels more like a hack (we have not changed anything in YARA, except for adding a new build parameter).

Tested on both 64-bit Arch Linux and Debian Stretch with GCC 9.2.0. However, the bug is platform-independent.

@PeterMatula
Copy link
Collaborator

fixed in #763

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants