YARA-X: baixar versions anteriors

• Add `int64`, `int64be`, `uint64`, and `uint64be` built-in functions, and support for unsigned 64-bit integers and integer literals greater than `i64::MAX` (#806).
• Add `pe.offset_to_rva` function to `pe` module to convert file offsets to RVAs (07f7a94).
• Keep the width and signedness of protobuf integer fields (#806).
• Implement constant folding for integer division and modulus operations (#806).
• Raise warnings on implicit sign conversions that change constant values and unary operations on unsigned integers (#806).
• Allow the `yr dump` command to show information from the `zip` module (3bbe876).
• Link compiler errors and warnings to their documentation pages (d34819c).
• Expose `xor_key` for matching patterns in the C and Go APIs (#814).
• Performance and memory consumption improvements (#808, #810, 9c2b3c7).
• Improve Language Server with `Workspace Symbols` support, better `Code Completion` documentation, auto-importing modules on non-top-level symbol completion, and `--help`/`--version` CLI flags (#788, #792, #795, #797, #798).
• Improve documentation for `math.entropy` function (#783).
• BUGFIX：Limit the size of emitted WASM functions and return error when a rule condition is too large (#813).
• BUGFIX：Don't force `yara-x` default features in `yara-x-capi` (#802).
• BUGFIX：Avoid WASM trap when dividing `i64::MIN` by `-1` (7d16c1f).
• BUGFIX：Ensure quantifiers computed at runtime that are out of range are never satisfied (af690da).
• BUGFIX：Dix the number of iterations in loops over ranges when bounds overflow (697e36e).
• BUGFIX：Don't truncate 64-bit offsets and indexes on 32-bit platforms (9e00369).
• BUGFIX：Improve robustness of deserialized rule data validation (9d6a1d8).
• BUGFIX：Enhance C API robustness with comprehensive null checks and detailed error reporting (0ed7485).
• BUGFIX：Correct output line termination when progress bar is active in `yr scan` (029e9c9).

Contributors：@agreene0, @CfirTsabari, @chojuninengu, @prosperritty

• Add `Scanner.set_module_output` to Python bindings (#744).
• Add debug command for showing atoms (#748).
• Allow reading scan lists from stdin (#753).
• Performance improvements (#747, #750, #755, #756, #758, #775, #781, #782)
• Add support for more ELF machine types in `elf` module (23a75aa).
• BUGFIX：make yara-x-py's module features actually work (#766).
• BUGFIX：allow passing `pathlib.Path` to `add_include_dir` in the Python API (b846b3b).
• BUGFIX：reduce memory usage in parser (#761).
• BUGFIX：exclude non-matching files in NDJSON output (61a2dc2).

Contributors：@CfirTsabari, @matt-acsc, @king-tero

• Implement SIMD-accelerated masked literal matching (#691).
• Improve atom extraction heuristics for better performance (#690, 1e14f60).
• Improve scan performance by applying file size and file header constraints only to regular expressions (#741).
• Serialize Aho-Corasick automata directly with compiled rules for faster deserialization (3c61ef8).
• Add `--ignore-invalid-rules` CLI option to skip rules that fail to compile (#704).
• Expose `ignore_invalid_rules` in Python API (#711).
• Add type annotations to match and return data in Python API (#692).
• Add `yrx_scanner_max_matches_per_pattern` to C API and `Scanner.MaxMatchedPerPattern` to Go API (a33fa8e).
• Add `rlib` crate types to `yara-x-capi` and `yara-x-py` to allow linking into wrapper crates (3c411d8).
• Implement experimental `msi`, `vba`, and `olecf` modules (#709, 35e16ef).
• Parse ShellItems and malformed sections in `lnk` module (#722).
• Raise warning when patterns are unintendedly included in a set (#729).
• Improve code completion in language server by distinguishing enums from other fields (a59e311).
• Improve playground usability and add light/dark theme support (#701, #707, #731, 15f4984).
• BUGFIX：Prevent panics and provide clear error message for regular expressions exceeding size limits (89df3f7).
• BUGFIX：Prevent panic when `filesize` is compared to float values (328dcb3).
• BUGFIX：Allow Teddy pattern matching algorithm to propagate early termination and respect timeouts (9d62d72).
• BUGFIX：Correctly anchor patterns in `of` expressions with explicit offsets (439d642).
• BUGFIX：Properly report compile error when exceeding maximum local variables limit (af53582).
• BUGFIX：Escape special control characters in JSON and YAML serialization (#696).
• BUGFIX：Do not ignore `private` modifier on hex and regular expression patterns (#698).
• BUGFIX：Cap ZIP buffer pre-allocation to compressed size (#702).
• BUGFIX：Robustly encode 64-bit string handles for WASM (#710).
• BUGFIX：Align completions with default formatting in language server (#713).
• BUGFIX：Fix accuracy issues when computing profiling time spent on each rule (6364574).
• BUGFIX：Prevent naming conflicts in Python bindings by setting module name explicitly to `yara_x` (95fc833, 54435ac).
• BUGFIX：Add protection against null pointers in C API (bf95890).

Contributors：@1ndahous3 @kevinmuoz @malvidin @MichaelTheSynthCat @paul-atx @saguywalker @tlansec @wxsBSD @zdiff

- Add missing machine architecture types to pe module (#687).
- Add warning for single-byte patterns (71baa67).
- Add warning for duplicate patterns in a rule (9061803).
- Small optimization when generating structures from a protobuf (9255a3e).
- BUGFIX: Don't derive header constraints from patterns with certain flags (#689).
- BUGFIX: Prevent undefined behavior when deserializing rules from untrusted binary data (25efa37).
Contributors: @nugxperience @cherepanov74

What's Changed
- Improve scan performance by ignoring patterns that can't match due to file header constraints (#676).
- Optimize regular expression evaluation (#678).
- New --cpu-limit option for the CLI (e9ee494).
- BUGFIX: fix issues in atom extraction logic from regular expressions (#673).
- BUGFIX: stack overflow when compiling rules if YARA-X uses musl (#666).
Contributors: @FranciscoPombal @webknjaz

- Add support for modules developed in external crates (#655).
- Implement the fast scan mode and --fast-scan option for the CLI (297ceb9, a9ebdf7).
- Improve performance by grouping multiple matches expressions inside or conditions into a RegexSet (#657).
- Better YAML output for multi-line strings (a7b7581).
- Faster rendering of error and warning messages (88a5a44).
- BUGFIX: Multile issues in dex module, including incorrect parsing and out-of-memory errors (efb5cad, eccf374, 833660e, 38fdf8b, 5e89e5b).
- BUGFIX: Issue in bitsquatting logic in vt module (3a20364).
Contributors: @1ndahous3

- Multiple performance improvements (#623, #624, #626, #627, #629, #631, #632, #635, #649, #654).
- Implement constant folding for bitwise operations (#634).
- Allow specifying context size for matches (#644).
- Improvements in Language Server for better integration with neovim (#648).
- BUGFIX: Avoid panic while parsing certain rules (#640).
- BUGFIX: Avoid panic on bad reader input in the Python API (#643).
- BUGFIX: Handle null values while deserializing Cuckoo reports in cuckoo module. (#646).
- BUGFIX: Validate bool metadata as bool in Language Server diagnostics (#621).
Contributors: @king-tero @PeterMatula @nyx0 @kevinmuoz @tlansec @prosperritty

- Add full support for WASM. The whole yara-x create now can be built for WASM (#583, #588, #598).
- New playground at https://virustotal.github.io/yara-x/playground/ (#601).
- The yr check command now notifies users of all errors (#597).
- The yr check command will ignore warnings if errors exist (#600).
- Allow for logging arbitrary byte sequences (#613).
- Expose linter API of compiler to Python bindings (#612).
- Multiple improvements to Language Server (#593, #589).
- BUGFIX: Language Server now relative includes (#591).
Contributors: @kevinmuoz , @niallnsec, @prosperritty, @tlansec, @nyx0, @wxsBSD

- Multiple improvements in language server (#559, #560, #561, #564, #568, #579).
- Added deps command to the CLI tool that shows rule dependencies (#498).
- Improve macho module by parsing DYLD_CHAINED_IMPORT_ADDEND64 fixup format (#554).
- Some optimizations in WASM code generation (#563, #565).
- BUGFIX: avoid showing UNC paths in Windows (#579).
- BUGFIX: return error when define_global receives a structure with some key that is not a valid identifier (946665d)
Contributors: @PeterMatula @wxsBSD @prosperritty

- Add crx and dex modules to Python invoke API (#534).
- Add Python API for specifying the metadata that should be passed to modules (6bebe34):
- Output filenames that needs reformatting when using yr fmt --check (#538)
- Improve code completion suggestions in language server.
- BUGFIX: issue while parsing imports in macho module (#544).
- BUGFIX: preserve duplicate metadata entries when using -output-format=json (#550).
- BUGFIX: logic error causing a use-after-free in the block scanning API (0d1763e).
- BUGFIX: panic when an error occurs at the end of a source file, but the last character is a multi-byte UTF-8 character (56bff8a).
Contributors: @dguido @wxsBSD @PeterMatula @latonis

- Improvements in the parser to produce better Concrete Syntax Trees (#531, c46b3bd).
- BUGFIX: avoid panic when parsing some regular expressions (136ab9f).

- Make the parser stricter (#502).
- Implement dex module (#458).
- Implement C api console log (#515).
- Implement permhash for the crx module (#510).
- Implement the imports() method for the Rules object in the Python API (fd17833).
- Implement parsing for LC_LAZY_LOAD_DYLIB and LC_LOAD_UPWARD_DYLIB in macho module (#518).
- Raise warning when a global rule is used in a condition (a429c98).
- Raise warnings when the result of multiple hash functions is compared to strings that can't match the hash (74c005c).
- BUGFIX: properly parse dylib trie in macho module (#517).
- BUGFIX: panic when comparing two booleans with == (3fe7b38).
- BUGFIX: panic when an invalid escape sequence is found in some unicode strings (d12ca9e).
- BUGFIX: issues in the parser (ae9be7d, 4e1a74e).
- BUGFIX: don't acquire the GIL in the Python module during scan operations (4f38eda)
Contributors: @delvinru @latonis @wxsBSD

- New yr fix warnings command (#493).
- Generate more efficient WASM code for some expressions, reducing the size of compiled rules (5efc214, a865681).
- Improve the API for traversing the AST in DFS order (8443106, 2b67943).
- Raise invariant_expr warning in some for loops that can't be true (#499).
Contributors: @wxsBSD @egibs

- Add function for scanning files by path to the C and Go APIs (32bac10).
- Add version number to the Rust API (bdb53e8, #469).
- Add osabi field to elf module (afa0960).
- Avoid verifying patterns when the file size is not in the range specified in the rule condition (#473).
- Avoid emitting code that invokes search_for_patterns if not necessary (#487).
- Implement DFS iterator for expressions in AST (#488).
- BUGFIX: Check if AddressOfFunctions is zero while parsing PE files (#482).
Contributors: @vojone

- BUGFIX: don't mangle the C API function yrx_finalize and include it in the header files (#467).
- BUGFIX: fix some issues and edge cases in block scanning (d7873db).
Contributors: @metthal

- Implement block scanning API for Rust and C (#459, 185c2ee).
- Implement Golang and C APIs for setting global variables of type array and structure (#449).
- Add iterator for Rules object in Python (#463).
- BUGFIX: Inconsistency with legacy YARA in PE certificate subjects (445e7e4).
Contributors: @nmbarel

- BUGFIX: fix compilation in 32-bits platforms (#453).

- New warning suggesting the use of none of them instead of 0 of them.
- Added option --max-matches-per-pattern to the CLI and the max_matches_per_pattern method to the Python API (#437).
- New yrx_finalize function to the C API that allows dynamically unloading the YARA-X library (#445).
- Add yrx_compiler_add_include_dir function to the C API (#447).
- Replace the Formatter::ident_spaces method with Formatter::indentation (b8a1808).
- BUGFIX: Indentation issues in code formatter (6bfe2e2).
- BUGFIX: Inconsistencies in code formatter with empty lines at the end of the code (de10bbd).
- BUGFIX: High memory consumption while parsing some PE files (af18dbc, #443)
- BUGFIX: Prevent panic when assertions like \b and \B are used in Unicode regexps (0536ad1).
Contributors: @1ndahous3 @jtpox @vojone

- Implement --no-mmap option for disabling the use of memory-mapped files (9ff675f).
- Support relative includes for compatibility with YARA (89674f1).
- Support metadata validation using regular expressions (#434).
- Added support for global variables of type dict in the Python API (#433).
- BUGFIX: Detect circular includes and raise an error instead of panicking (624429f).
- BUGFIX: Issue in hoisting algorithm causing false-positive in some with statements (f0f5b0a).
- BUGFIX: Multiple issues with Python stub file yara_x.pyi (4d83594).
Contributors: @nmbarel @prosperritty @zdiff

- Implement the crx module for parsing Chrome Extension files (#423).
- Allow underscores in integer and float literals (#405).
- Adopt Anomali's symhash algorithm for Mach-O files (#425).
- Support boolean type in console.log() (#406).
- Allow specifying include directories in the C, Go and Python APIs (45a03c6).
- Improvements while parsing importa and exports in Mach-O files (#417, #421).
- Improve performance for patterns with the xor modifier. The performance gain can be noticeable for certain rules (0122fa9).
- Return an error with rules that can have arbitrarily long prefixes (c8bbede).
- BUGFIX: Fix misleading help text in text_as_hex warning (e61a74e).
- BUGFIX: Minor formatting issues in yr fmt command (43fbdc5).
- BUGFIX: Fix panic when a rule contains an invalid regexp and the rule name is reused (a50f3db).
- BUGFIX: Fix panic with regular expressions that contain too many alternatives (7ad6d8f).
- BUGFIX: Make some functions in cuckoo module backward-compatible with YARA (#424).
Contributors: @MichaelTheSynthCat @latonis @wxsBSD @1ndahous3

- Allow suppressing warnings using // suppress: warning_id comments (#398).
- Implement built-in functions float32, float64, float32be and float64be (#396).
- BUGFIX: fix wrong text_as_hex warning (0baf08b, #397).
- BUGFIX: false positive in wide regular expressions (5fd5015, #395)

- Add span information to Event::Begin and Event::End (f4259f0).
- Add support for private patterns. Private patterns were being accepted but ignored. (21a9090).
- BUGFIX: add YRX_ prefix to constants in the C API to avoid name collisions (#382).
- BUGFIX: increase MAX_ATOMS_PER_REGEXP from 8192 to 10000 (#387, 664abac).

- BUGFIX: regression introduced in #368.
- BUGFIX: more robust LNK file parsing than handles maliciously crafted files (7e1c8b3, #379)

- Allow disabling specific warnings via the configuration file (b44ca8f) (documentation).
- BUGFIX: Another JSON encoding issue (1a41075, #376).
- BUGFIX: Return a proper error message when passing invalid metadata to a module (#368).
Contributors: @vojone

- Add the yrx_scanner_set_module_data function to the C API.
- Show warnings when comparing the result of intXX and uintXX functions with values outside their valid ranges. Example:
warning[unsatisfiable_expr]: unsatisfiable expression
--> demo.yar:6:3
|
6 | uint8(0) == 0x1FF
| -------- ----- this integer is outside the range [0,255]
| |
| this expression is an integer in the range [0,255]
|
- BUGFIX: Less strict schema for Cuckoo reports (#369).
- BUGFIX: CLI reports UTF-8 encoding errors instead of ignoring them silently (2372d68) (thanks to @craiu for the report)
- BUGFIX: Fix issue in the Python API while parsing JSON data (#365, c3ad3ac).
Contributors: @vojone @szabgab

- BUGFIX: Panic while truncating long file paths containing Unicode characters (#360).
- BUGFIX: JSONDecodeError in Python API (#361).

- First stable release!
- Raise warning when loops can have too many iterations (#352).
- Raise warning when comparing a string that is known to be lowercase (like the result of hash.md5) with a string that contains uppercase characters (150500b). Example:
warning[unsatisfiable_expr]: unsatisfiable expression
--> line:5:9
|
5 | test_proto2.string_foo == "FOO"
| ---------------------- ----- this contains uppercase characters
| |
| this is a lowercase string
|
= note: a lowercase string can't be equal to a string containing uppercase characters
- Better handling of raw bytes and timestamps when decoding module outputs from Python (#357, d65a92a).

- Implement include statements (#350).
- Add module invoke support to Python API (#348).
- BUGFIX: Parsing aborted when too many rules had the global or private modifiers (d9a1f97).
Contributors: @wxsBSD

- Parse LC_DYLD_EXPORTS_TRIE in Mach-O files (#303).
- Parse chained fixup imports via LC_DYLD_CHAINED_FIXUPS in Mach-O files (#305).
- Implement tag linter (#304).
- Implement regex anchors ^ and $ in multi-line mode (8b01882).
- Add support for 32-bits targets.
- Improve performance by memoizing some function calls (#311).
- Open source the vt module.
- BUGFIX: Do not abort parsing when .NET file has a table with more than MAX_ROWS_PER_TABLE (908009b).
- BUGFIX: Prevent infinite loop due to cycles in certificate chain (a751199).
Contributors: @latonis, @wxsBSD, @JonathanAnbary

- Implemented basic linting via the check command.
- Refactor the format of JSON output (#281).
- Parse Mach-O certificates (#276).
- Allow using previously defined variables in with statements (#287).
- BUGFIX: prevent the fmt command from modifying binary files accidentally.
- BUGFIX: fix panic when path starts with ./(#280).
- BUGFIX: reduce consumption of process address space (#292).
Contributors: @chudicek @latonis @wxsBSD