error: syntax error, unexpected <base64>, expecting identifier

[staticdnweb]

i got this error:

/root/php-malware-finder/php-malware-finder/php.yar(95): warning: $pr contains .* or .+, consider using .{,N} or .{1,N} with a reasonable value for N
/root/php-malware-finder/php-malware-finder/php.yar(209): error: syntax error, unexpected <base64>, expecting identifier
/root/php-malware-finder/php-malware-finder/php.yar(271): error: syntax error, unexpected <base64>

PHP 7.1.33
Yara 3.11.0

Thanks !

[jvoisin]

Can you show what command you're using to run php-malware-finder?

[staticdnweb]

i use this command:
yara -r php-malware-finder/php-malware-finder/php.yar /tmp/woocommerce-tm-extra-product-options

[jvoisin]

It seems that something is wrong with your yara installation:

$ yara -r php-malware-finder/php-malware-finder/php.yar /tmp 
php-malware-finder/php-malware-finder/php.yar(95): warning: $pr contains .* or .+, consider using .{N} or .{1,N} with a reasonable value for N
DodgyPhp /tmp/phpEbOPT8
DodgyPhp /tmp/phpSluTUi
DodgyPhp /tmp/phpJSzldz
$ yara --version
3.8.1
$

[jasonhildebrand]

I got the same error:
/root/php-malware-finder/php-malware-finder/php.yar(209): error: syntax error, unexpected <base64>, expecting identifier

I had compiled yara from scratch. I found that in the current version of yara (4.0.0), "base64" is a reserved word. This is not the case in older versions of yara. Reverting to yara 3.11.0 resolved the issue for me and allowed php-malware-finder to run.

[jvoisin]

This should be fixed by 08214fc

Thanks for investigating!

[jasonhildebrand]

Thanks for the quick response on this!