pdfalyzer 1.14.7__tar.gz → 1.14.8__tar.gz

{pdfalyzer-1.14.7 → pdfalyzer-1.14.8}/CHANGELOG.md

@@ -1,5 +1,8 @@
 # NEXT RELEASE
 
+### 1.14.8
+* Handle internal YARA errors more gracefully with error messages instead of crashes (currently seeing `ERROR_TOO_MANY_RE_FIBERS` on macOS on some files for unknown reasons that we hope will go away eventually)
+
 ### 1.14.7
 * Bump `yaralyzer` version to 0.9.4 (and thus bump `yara-python` to 4.3.0+)
 * Remove unused imports, remove unused `requirements.txt` file.

{pdfalyzer-1.14.7 → pdfalyzer-1.14.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pdfalyzer
-Version: 1.14.7
+Version: 1.14.8
 Summary: A PDF analysis toolkit. Scan a PDF with relevant YARA rules, visualize its inner tree-like data structure in living color (lots of colors), force decodes of suspicious font binaries, and more.
 Home-page: https://github.com/michelcrypt4d4mus/pdfalyzer
 License: GPL-3.0-or-later

{pdfalyzer-1.14.7 → pdfalyzer-1.14.8}/pdfalyzer/__init__.py

@@ -72,7 +72,7 @@ def pdfalyze():
 
 
 def pdfalyzer_show_color_theme() -> None:
-    """Utility method to show pdfalyzer's color theme. Invocable with 'pdfalyzer_show_colors'."""
+    """Utility method to show pdfalyzer's color theme. Invocable with 'pdfalyzer_show_color_theme'."""
     console.print(Panel('The Pdfalyzer Color Theme', style='reverse'))
 
     colors = [

{pdfalyzer-1.14.7 → pdfalyzer-1.14.8}/pdfalyzer/output/layout.py

@@ -65,5 +65,9 @@ def print_headline_panel(headline, style: str = ''):
     _print_header_panel(headline, style, False, console_width())
 
 
+def print_fatal_error_panel(headline):
+    print_headline_panel(headline, style='red blink')
+
+
 def _print_header_panel(headline: str, style: str, expand: bool, width: int, padding: tuple = (0,)) -> None:
     console.print(Panel(headline, style=style, expand=expand, width=width or subheading_width(), padding=padding))

{pdfalyzer-1.14.7 → pdfalyzer-1.14.8}/pdfalyzer/output/pdfalyzer_presenter.py

@@ -4,6 +4,7 @@ Handles formatting of console text output for Pdfalyzer class.
 from collections import defaultdict
 from typing import Optional
 
+import yara
 from anytree import LevelOrderIter, RenderTree, SymlinkNode
 from anytree.render import DoubleStyle
 from rich.markup import escape
@@ -20,7 +21,8 @@ from pdfalyzer.config import PdfalyzerConfig
 from pdfalyzer.decorators.pdf_tree_node import DECODE_FAILURE_LEN
 from pdfalyzer.detection.yaralyzer_helper import get_bytes_yaralyzer, get_file_yaralyzer
 from pdfalyzer.helpers.string_helper import pp
-from pdfalyzer.output.layout import print_section_header, print_section_subheader, print_section_sub_subheader
+from pdfalyzer.output.layout import (print_fatal_error_panel, print_section_header, print_section_subheader,
+     print_section_sub_subheader)
 from pdfalyzer.output.tables.pdf_node_rich_table import generate_rich_tree, get_symlink_representation
 from pdfalyzer.output.tables.stream_objects_table import stream_objects_table
 from pdfalyzer.output.tables.decoding_stats_table import build_decoding_stats_table
@@ -124,8 +126,15 @@ class PdfalyzerPresenter:
     def print_yara_results(self) -> None:
         """Scan the overall PDF and each individual binary stream in it with yara_rules/ files"""
         print_section_header(f"YARA Scan of PDF rules for '{self.pdfalyzer.pdf_basename}'")
-        YaralyzerConfig.args.standalone_mode = True  # TODO: this sucks
-        self.yaralyzer.yaralyze()
+        YaralyzerConfig.args.standalone_mode = True  # TODO: using 'standalone mode' like this kind of sucks
+
+        try:
+            self.yaralyzer.yaralyze()
+        except yara.Error as e:
+            console.print_exception()
+            print_fatal_error_panel("Internal YARA error! YARA's error codes can be checked here: https://github.com/VirusTotal/yara/blob/master/libyara/include/yara/error.h")
+            return
+
         YaralyzerConfig.args.standalone_mode = False
         console.line(2)
 

{pdfalyzer-1.14.7 → pdfalyzer-1.14.8}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "pdfalyzer"
-version = "1.14.7"
+version = "1.14.8"
 description = "A PDF analysis toolkit. Scan a PDF with relevant YARA rules, visualize its inner tree-like data structure in living color (lots of colors), force decodes of suspicious font binaries, and more."
 authors = ["Michel de Cryptadamus <michel@cryptadamus.com>"]
 license = "GPL-3.0-or-later"