YARA v3.6.1

• BUGFIX: Stack overflow caused by uncontrolled recursiveness (CVE-2017-9304)
• BUGFIX: pe.overlay.size was undefined if the PE didn't have an overlay. Now it's set to 0 in those cases.
• BUGFIX: Fix initalization issue that could cause a crash if rules compiled with a 32bit yarac is used with a 64bit yara.

Refer to the documentation for information on how to build and install YARA.

YARA v3.6.0

• .NET module (Wesley Shields)
• New features for ELF module (Jacob Baines)
• Fix endianness issues (Hilko Bengen)
• Function yr_compiler_add_fd added to libyara
• MAX_THREADS limit can be arbitrarily increased (Emerson R. Wiley)
• Added --fail-on-warnings command-line option
• Multiple bug fixes

Refer to the documentation for information on how to build and install YARA.

YARA v3.5.0

• Match length operator (http://yara.readthedocs.io/en/v3.5.0/writingrules.html#match-length)
• Performance improvements
• Less memory consumption while scanning processes
• Exception handling when scanning memory blocks
• Negative integers in meta fields
• Added the --stack-size command-argument
• Functions import_ordinal, is_dll, is_32bit and is_64bit added to PE module
• Functions rich_signature.toolid and rich_signature.version added to PE module
• Lots of bug fixes

Refer to the documentation for information on how to build and install YARA.

YARA v3.4.0

• Short-circuit evaluation for conditions
• New yr_rules_save_stream/yr_rules_load_stream APIs.
• load() and save() methods in yara-python accept file-like objects
• Improvements to the PE and ELF modules
• Some performance improvements
• New command-line option --print-module-data
• Multiple bug fixes.

Refer to the documentation for information on how to build and install YARA.

YARA v3.3.0

• Added support for negative integers and floating point numbers
• Implemented operators >,<, >=, <= for strings
• Implemented word boundary anchors (\b, \B) in regular expressions
• New features in PE module
• Math module
• New --print-namespace command line argument
• Better error handling in low memory conditions
• BUGFIX: "at" operator not working with certain strings containing wildcards
• BUGFIX: precedence of bitwise operators was incorrect
• BUGFIX: incorrect imphash result for certain PE files importing functions by ordinal
• BUGFIX: handle and memory leaks
• BUGFIX: multiple segfaults

Refer to the documentation for information on how to build and install YARA.

YARA v3.2.0

• ELF module
• Hash module
• New features in PE module
• Big-endian version of intXX and uintXX functions
• Modules can declare dictionary objects
• Modules accept overloaded functions
• Performance improvements
• BUGFIX: "and" operator not working properly with integer operands
• BUGFIX: False positive with strings declared as "fullword wide ascii"
• BUGFIX: False positive with "wide fullword" strings shorter than 5 bytes
• BUGFIX: Functions declared in a structure array not working properly
• BUGFIX: "contains" operator causing segfault if operand is an undefined string

Refer to the documentation for information on how to build and install YARA.

YARA v3.1.0

• Magic module
• Zero-length file are treated as normal files
• Modules now must implement module_initialize and module_finalize functions
• Accept functions without arguments in modules
• BUGFIX: Fix issue with module functions receiving more than one regular expressions
• BUGFIX: Show appropriate error message while trying to import unknown module
• BUGFIX: Fix segfaults caused by improper buffer bounds validation in PE module
• BUGFIX: Fix dns_lookup function in PE module

Refer to the documentation for information on how to build and install YARA.

YARA v3.0.0

• Support for modules
• PE module
• Cuckoo module
• Some improvements in the C API
• More comprehensive documentation
• BUGFIX: Start anchor (^) not working properly with the "matches" operator
• BUGFIX: False negative with certain regular expressions
• BUGFIX: Improper handling of nested includes with relative pathes
• BUGFIX: \s character class not recognizing \n, \r, \v and \f as spaces
• BUGFIX: YARA for Win64 scanning only the first 4GB of files.
• BUGFIX: Segmentation fault when using nested loops
• BUGFIX: Segmentation fault caused by invalid characters in regular expressions
• BUGFIX: Segmentation fault while scanning some processes in Windows
• BUGFIX: Segmentation fault caused by regexp code spanning over non-contiguous
  memory pages

Refer to the documentation for information on how to build and install YARA.

YARA v2.1.0

• Improve regexp engine
• Improve multithreading support
• Case-insensitive and single-line matching modes for "matches" operator's regexps
• Added "error_on_warning" argument to "match" in yara-python
• Recognize x64 PE files
• BUGFIX: Mutex handle leak
• BUGFIX: NULL pointer dereferences
• BUGFIX: Buffer overflow
• BUGFIX: Crash while using compiled rules with yara64 in Windows
• BUGFIX: Infinite loop while scanning 64bits process in Windows
• BUGFIX: Side-effect on "externals" argument in yara-python's "match" function
• BUGFIX: "x of them" not working with strings containing unbounded jumps

Refer to the documentation for information on how to build and install YARA.

YARA v2.0.0

• Faster matching algorithm
• Command-line scanner is now multi-threaded
• Compiled rules can be saved to and loaded from a file
• Added support for unbounded jumps
• New libyara API

Refer to the documentation for information on how to build and install YARA.