I recently had to help out a friend with a YARA error. I've never seen this before, but the YARA error was just a number, not an error description.

An error description would be, for example, something like "syntax error".

But here it was just a number: error number 4.

I looked at Windows Error codes: error 4 is ERROR_TOO_MANY_OPEN_FILES

That didn't make sense in this situation here.

So I started to look at YARA's source code on github, and found this file: error.h.

Error 4 is: ERROR_COULD_NOT_MAP_FILE

Thus, if you have a numeric YARA error, look it up in this file to know what it means: error.h

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com