Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement text string sets. #1787

Merged
merged 2 commits into from
Sep 23, 2022
Merged

Conversation

wxsBSD
Copy link
Collaborator

@wxsBSD wxsBSD commented Sep 9, 2022

Add support for text string sets into the grammar. They look like this:

for any s in ("a", "b"): (pe.imphash() == s)

This requires changing integer_set and integer_enumeration to just be set and enumeration, and adding a new type (YR_ENUMERATION) that tracks the type of enumeration (integer or otherwise) and the number of items in the enumeration.

The enumeration now checks that each type of the item in the enumeration is consistent and will cause a compiler error if they are not. For example, this is an error:

for any s in ("a", 0): (s)

Also, fix the build when using --with-debug-verbose option as it was missing the assert.h include.

Add support for text string sets into the grammar. They look like this:

for any s in ("a", "b"): (pe.imphash() == s)

This requires changing integer_set and integer_enumeration to just be set and
enumeration, and adding a new type (YR_ENUMERATION) that tracks the type of
enumeration (integer or otherwise) and the number of items in the enumeration.

The enumeration now checks that each type of the item in the enumeration is
consistent and will cause a compiler error if they are not. For example, this is
an error:

for any s in ("a", 0): (s)

Also, fix the build when using --with-debug-verbose option as it was missing the
assert.h include.
@wxsBSD
Copy link
Collaborator Author

wxsBSD commented Sep 9, 2022

Closes #1765.

@wxsBSD
Copy link
Collaborator Author

wxsBSD commented Sep 9, 2022

Forgot to mention that I'll update docs before merging if this looks good.

@plusvic
Copy link
Member

plusvic commented Sep 12, 2022

Looks good to me.

@plusvic
Copy link
Member

plusvic commented Sep 12, 2022

Waiting for doc update before merging.

@plusvic plusvic merged commit d6fc080 into VirusTotal:master Sep 23, 2022
@wxsBSD wxsBSD deleted the text_string_sets branch September 23, 2022 19:25
wxsBSD added a commit to wxsBSD/gyp that referenced this pull request Dec 23, 2022
This adds support for text string sets (VirusTotal/yara#1787).
plusvic pushed a commit to VirusTotal/gyp that referenced this pull request Dec 29, 2022
This adds support for text string sets (VirusTotal/yara#1787).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants