[Tito0015]

Fixes #451

Summary

• E002 — malware/APT_CrashOverride.yar: replace pe.exports(Crash) & pe.characteristics with pe.exports(Crash) and pe.characteristics != 0.
• E014 — malware/RAT_PlugX.yar: add missing path separator before VMwareCplLauncher (\\V not \V).
• E014 — malware/RAT_PoetRATPython.yar: remove trailing | that made the regex match empty strings.
• E014 — webshells/Wshell_ChineseSpam.yar: escape literal { as \{.

CrashOverride note

pe.exports() is boolean in yara-x; legacy YARA coerced the old & conjunct. We use and pe.characteristics != 0 for type-safe parity with that behavior rather than guessing a specific PE characteristics bit mask or deleting the clause. Valid PE files almost never have characteristics == 0, so this remains a no-op once the export check passes.

Verification

• yr compile index.yar — exit 0
• Legacy yara64.exe index.yar dummy.bin — exit 0 (no syntax errors on stderr)

Engines tested: yara-x-cli 1.21.0 (yr -V); YARA 4.5.5 (yara64.exe --version, VirusTotal v4.5.5-2368-win64.zip fallback).

[Tito0015]

Hi @Xumeiquer @initpwn,

Friendly bump on this PR when you have a moment!

It resolves the YARA-X compilation errors in #451 across index.yar with strict type-safety and regex compatibility, while keeping full backwards compatibility with legacy C-YARA.

Also, GitHub is currently waiting on maintainer approval to run the Actions workflow checks. Thanks!