Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

When using the -z option, the -w option does not disable warnings about files skipped due to them being larger than the maximum file size #2137

Open
J-A-Sec opened this issue Feb 18, 2025 · 0 comments
Labels

Comments

@J-A-Sec
Copy link

J-A-Sec commented Feb 18, 2025

Describe the bug
When a maximum file size to scan is specified with the -z option, the -w option does not disable warnings about files skipped due to them being larger than the maximum file size.

To Reproduce

  1. Download the latest x64 YARA windows binary
  2. Run YARA against a folder that contains files larger than the specified maximum file size, for example, using PowerShell and specifying a 5MB size limit: .\YARA64.exe -w -r -z 5242880 -C .\rule_file.yar "C:\windows\temp"
  3. Observe that warnings are produced, such as: skipping C:\windows\temp\file.msi (5525504 bytes) because it's larger than 5242880 bytes.

Expected behavior
It's expected that no warnings are produced because of the -w option.

Please complete the following information:

  • OS: Windows Server 2019
  • YARA version: 4.5.2 x64
  • Microsoft Visual C++ Redistributable version: v14.42.34438.00

Additional context
I have tried the following with no success:

  • The full option "--no-warnings"
  • Rearranging options

Thanks!

@J-A-Sec J-A-Sec added the bug label Feb 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant