If you encounter a problem using Yaramod, it is usually easy to determine which of the four components the problem is related to:
ParserErrorindicates parsing problem and the message should include the first problematic token of the imput.
BuilderErrorprobably means that your service uses the Builder incorrectly.
If you use the
text_formattedin Python) method of a YARA file and the output seems wrong, the problem will be probably in the the
getTextmethod of the
TokenStreamclass. Please create a ticket and supply the input and the wrong output with some explanation so we can look into it.
There can also be some problems when using modifying visitors. In the case your modifying visitor modifies the unformatted text very well, but the formatted text is wrong (usually missing tokens or bad ordering of tokens) it may indicate unused method
ModifyingVisitorclass. Or the method could be used in a wrong matter. Please consult our examples in the section Modifying Rulesets and if that does not help consider contacting the authors.