Building on Windows

[hillu]

Hi, I'm the author of go-yara and I recently spent some time figuring out how to build libyara on Winows using MSYS2. Perhaps you'll find hillu/go-yara#78 (the issue that pointed me into the right direction) and https://github.com/hillu/go-yara/blob/master/README.cross-building.md#example-building-on-windows-using-msys2 (the resulting condensed description) useful.

[targodan]

Thank you for the pointer! 👍

I'll have a look at those resources and try to get it working on windows.

[targodan]

Thanks again @hillu! Thanks to your notes I got it working. The automation part was a bit fiddly, but I got it working in the end.

Here are some of my findings/results you might also find interesting:

• Adding the line // #cgo yara_static LDFLAGS: -static to my yara.go allowed me to build a true-static binary without having to fiddle with the CGO_LDFLAGS environment variable. (although I still had to fiddle with the library path 🙄 )
• I wrote a powershell (and some bash) scripts to have as close to a one-click solution as I was comfortable with. The user still has to install Golang, MSYS2 and some build-dependencies via pacman, but then cicd/buildOnWindows.ps1 takes care of the rest. It optionally calls msys64, to execute the script cicd/buildAndInstallDependencies.sh and once that's done it compiles yapscan.exe

Some reasoning for my decisions/further explanation of what you might stumble across:

• I went the powershell route, since I didn't like the idea of trying to get the go toolchain working within msys.
• In addition to yara, I have OpenSSL as a dependency because the PE-plugin of yara requires something in libcrypto

Feel free to make use of what you might find useful in my scripts. :)

EDIT: Any changes are, so far, only available in the develop branch. Once I merge into master, I'll close this issue. But we can still use it as a discussion platform, if you have further questions. :)

[hillu]

Glad you made progress. OpenSSL on Windows is only needed for Authenticode signature (pe.signatures[*].* support in YARA rules. Anything related to hash functions will use the Windows CryptoAPI functions instead if OpenSSL is not available. (And if I ever get a variant of VirusTotal/yara#1423 merged, the requirement may go away altogether.)

If I can be of further help, feel free to ask.

[targodan]

Thanks for the clarification, all I saw was that some rule didn't work and google told me the PE module needs openssl. Would be cool if that could be merged! I left a +1 on that merge request.

[targodan]

Thanks again for you help. The build process for windows is described in the README. It uses mingw64 and I have provided powershell build scripts in the cicd/ folder.