YARA v4.0.0
- New string modifiers base64 and base64wide (#1185).
- New string modifier private (#1096).
- Iterators for dictionaries and arrays (#1141).
- Multiple API changes.
- Memory footprint greatly reduced, specially when compiling large numbers of rules.
- New commmand-line option --scan-list (#1261).
- Added pdb_path field to "pe" module.
- Added export_details array to "pe" module.
- Added exports_index functions to "pe" module.
- Improvements to "cuckoo" module.
- BUGFIX: PE files with multiple signatures are parsed correctly (#940).
- BUGFIX: Fix PE rich header parsing (#1164).
- BUGFIX: Buffer overruns in "dotnet" module (#1167, #1173).