Skip to content

Go ReadFrom performance issues on large rule files #209

Closed
@zdiff

Description

@zdiff

using ReadFrom is much slower than a similar function in go-yara on large rule files:

YARA-X ReadFrom

Command Mean [s] Min [s] Max [s] Relative
./go-yara-x-test 319.087 ± 36.415 268.215 391.082 1.00
hyperfine ./go-yara-test --export-markdown yara-x.md
Benchmark 1: ./go-yara-test
  Time (mean ± σ):     319.087 s ± 36.415 s    [User: 318.592 s, System: 0.478 s]
  Range (min … max):   268.215 s … 391.082 s    10 runs

Source

package main

import (
        "bytes"
        _ "embed"
        "log"

        yara "github.com/VirusTotal/yara-x/go"
)

//go:embed rule.yarc
var rule []byte

func main() {

        _, err := yara.ReadFrom(bytes.NewReader(rule))
        if err != nil {
                log.Fatal(err)
        }

}

go-yara ReadRules

Command Mean [s] Min [s] Max [s] Relative
./go-yara-test 1.992 ± 0.313 1.683 2.700 1.00
hyperfine ./go-yara-test --export-markdown go-yara.md
Benchmark 1: ./go-yara-test
  Time (mean ± σ):      1.992 s ±  0.313 s    [User: 1.849 s, System: 0.164 s]
  Range (min … max):    1.683 s …  2.700 s    10 runs
package main

import (
	"bytes"
	_ "embed"
	"log"

	"github.com/hillu/go-yara/v4"
)

//go:embed rule.yarc
var rule []byte
func main() {

	_, err := yara.ReadRules(bytes.NewReader(rule))
	if err != nil {
		log.Fatal(err)
	}

}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions