I am guessing that what's going on is that before the change, it would abandon antidebug_antivm.yar rules when any of them failed to load, and that with the change, it only skips the ones that fail to load.
Before the change, I see:
LibClamAV Error: cli_loadyara: failed to parse rules file /Users/micasnyd/antidebug_antivm.yar, error count 7
With the change, I see:
LibClamAV Warning: cli_loadyara: failed to parse or load 7 yara rules from file /Users/micasnyd/antidebug_antivm.yar, successfully loaded 92 rules.
I haven't yet taken the time to identify which rules in antidebug_antivm.yar are failing, remove them, and verify if one of them still causes a crash in 0.99 and 0.100
It seems to me that the assertion fail 'crash' when using antidebug_ antivm. yar comes about after this commit:
https:/ /github. com/Cisco- Talos/clamav- devel/commit/ 5891f83422e699f 70e9f9bdcbcc963 3f9a4cd5ef
Derived from: /bugzilla. clamav. net/show_ bug.cgi? id=11567
https:/
I am guessing that what's going on is that before the change, it would abandon antidebug_ antivm. yar rules when any of them failed to load, and that with the change, it only skips the ones that fail to load.
Before the change, I see: micasnyd/ antidebug_ antivm. yar, error count 7
LibClamAV Error: cli_loadyara: failed to parse rules file /Users/
With the change, I see: micasnyd/ antidebug_ antivm. yar, successfully loaded 92 rules.
LibClamAV Warning: cli_loadyara: failed to parse or load 7 yara rules from file /Users/
I haven't yet taken the time to identify which rules in antidebug_ antivm. yar are failing, remove them, and verify if one of them still causes a crash in 0.99 and 0.100