TypeError: 'yara.StringMatch' object is not subscriptable

[4hem]

Failed while executing plugin_t.run():
Traceback (most recent call last):
File "D:/tools/IDA_Pro_7.7/plugins/findcrypt3.py", line 224, in run
self.search()
File "D:/tools/IDA_Pro_7.7/plugins/findcrypt3.py", line 180, in search
values = self.yarasearch(memory, offsets, rules)
File "D:/tools/IDA_Pro_7.7/plugins/findcrypt3.py", line 197, in yarasearch
self.toVirtualAddress(string[0], offsets),
TypeError: 'yara.StringMatch' object is not subscriptable

[serv0id]

#45

[muha2xmad]

The same problem here with yara-python 4.3.1

[muha2xmad]

I solved this problem by installing yara-python 4.2

[1198287349]

The yarsearch function needs to be modified as follows：

def yarasearch(self, memory, offsets, rules):
print(">>> start yara search")
values = list()
matches = rules.match(data=memory)
for match in matches:
for stringR in match.strings:
name = match.rule
for string in stringR.instances:
if name.endswith("API"):
try:
name = name + "" + idc.GetString(self.toVirtualAddress(string.offset, offsets))
except:
pass
value = [
self.toVirtualAddress(string.offset, offsets),
match.namespace,
name + "" + hex(self.toVirtualAddress(string.offset, offsets)).lstrip("0x").rstrip("L").upper(),
stringR.identifier,
repr(string.matched_data)
]
idaapi.set_name(value[0], name
+ ""
+ hex(self.toVirtualAddress(string.offset, offsets)).lstrip("0x").rstrip("L").upper()
, 0)
values.append(value)
print("<<< end yara search")
return values