Can't import "hash"

[tungpun]

➜  yara-python git:(master) ✗ python                                          
Python 2.7.6 (default, Jun 22 2015, 17:58:13) 
[GCC 4.8.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import yara
>>> rule = yara.compile(source='import "hash"')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
yara.SyntaxError: line 1: syntax error, unexpected _IDENTIFIER_, expecting $end or _RULE_ or _PRIVATE_ or _GLOBAL_

I try to write a python script to load .yara file, which contain import "hash" but it doesn't work

[plutec]

@tungpun which version of yara do you have? try this:

$ echo "import \"hash\"" > rule.yar && yara rule.yar rule.yar

Works?

[tungpun]

@plutec I use yara 3.4.0 on Ubuntu (x86_64) If I save import "hash" and run with yara via command line. It works (no error were found)

$ yara -v                                                           
yara 3.4.0
$ echo 'import "hash"' > test.yara                               
$ yara -r test.yara .                                                                
$        

But in python, it returns syntax error:

[rholloway]

I'm having similar issues with both yara 3.4.0 and yara 3.5.0 at least. I cannot compile from within yara-python rules that use import "pe". However, they compile just fine with yarac from command line.

[edeca]

Also see: https://github.com/VirusTotal/yara-python/issues/27

[justNik101]

i have this issue when i am compiling ( python yara version 3.6.3 - windows) a yara file with import "hash" but it's working well for importing pe

[JScharloo]

I am also having this issue. When I yara.compile a rule which contains an import statement (both pe and hash) I get the error mentioned in the first post. Works outside the library though.

Would love to be able to use YARA modules in my rulesets being used in conjunction with this python library.

[damelo]

Solved installing python-openssl on Ubuntu.

[cgupta6]

I resolved it using and worked for me: pip install --global-option="build" --global-option="--enable-cuckoo" --global-option="--enable-magic" yara-python

[lesander]

I can confirm that this issue still persists on yara-python 3.11.0 running on Windows 10 x64. Manually building does not fix the issue, for some reason HAVE_LIBCRYPTO is not set correctly in setup.py

[utkonos]

The pip command above that works for some users does not appear to work correctly on macOS. If the problem persists try the following:

git clone --recursive [email protected]:VirusTotal/yara-python.git
python setup.py build --dynamic-linking
python setup.py install