Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.Sign up
Yara md5_0b1bfb0bdc7e017baccd05c6af6943ea false matches #253
The following yara rule is causing a false match on a popular XenForo addon
It's matching the Core.php file which has the following
Full file on pastebin
It's worth mentioning that the code in question is emulating functionality in vBulletin. Due to the nature of vBulletin code (plenty of eval's) it is very likely that rule will hit a lot of vBulletin installations.
I will be working around this bug in my code, but this issue should be fixed (or an option added to disable individual rules), otherwise this product can cause severe data loss and disruption of functionality for vBulletin forums.