VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-12 02:10:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Implemented metadata feature

Browse Source
This commit is contained in:
Victor M. Alvarez
2009-10-24 23:19:51 +00:00
parent aae781475b
commit 3442f8afdf
28 changed files with 1991 additions and 1816 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ChangeLog
+6 -4
View File
@@ -35,8 +35,10 @@ version 1.2.1 (14/04/2009)
* BUGFIX: Memory leak
* BUGFIX: Access violation on xxcompare functions
version 1.2.2
* added support for #include
* BUGFIX: Incorrect handling of single-line comments at the end of the file
* BUGFIX: Integer underflow when scanning files of size <= 2 bytes
version 1.3
* added a C-like "include" directive
* added support for multi-sources compilation in yara-python
* added support for metadata declaration in rules
* BUGFIX: Incorrect handling of single-line comments at the end of the file
* BUGFIX: Integer underflow when scanning files of size <= 2 bytes
Makefile
+14 -14
View File
@@ -85,11 +85,11 @@ DIST_ARCHIVES = $(distdir).tar.gz
GZIP_ENV = --best
distuninstallcheck_listfiles = find . -type f -print
distcleancheck_listfiles = find . -type f -print
ACLOCAL = ${SHELL} /Users/plusvic/Projects/yara/missing --run aclocal-1.10
AMTAR = ${SHELL} /Users/plusvic/Projects/yara/missing --run tar
AUTOCONF = ${SHELL} /Users/plusvic/Projects/yara/missing --run autoconf
AUTOHEADER = ${SHELL} /Users/plusvic/Projects/yara/missing --run autoheader
AUTOMAKE = ${SHELL} /Users/plusvic/Projects/yara/missing --run automake-1.10
ACLOCAL = ${SHELL} /Users/plusvic/Projects/yara/trunk/missing --run aclocal-1.10
AMTAR = ${SHELL} /Users/plusvic/Projects/yara/trunk/missing --run tar
AUTOCONF = ${SHELL} /Users/plusvic/Projects/yara/trunk/missing --run autoconf
AUTOHEADER = ${SHELL} /Users/plusvic/Projects/yara/trunk/missing --run autoheader
AUTOMAKE = ${SHELL} /Users/plusvic/Projects/yara/trunk/missing --run automake-1.10
AWK = awk
CC = gcc
CCDEPMODE = depmode=gcc3
@@ -111,24 +111,24 @@ LDFLAGS =
LIBOBJS =
LIBS = -lpcre -lpcre -lpcre -lpcre
LTLIBOBJS =
MAKEINFO = ${SHELL} /Users/plusvic/Projects/yara/missing --run makeinfo
MAKEINFO = ${SHELL} /Users/plusvic/Projects/yara/trunk/missing --run makeinfo
MKDIR_P = ./install-sh -c -d
OBJEXT = o
PACKAGE = yara
PACKAGE_BUGREPORT = [email protected]
PACKAGE_NAME = yara
PACKAGE_STRING = yara 1.2.1
PACKAGE_STRING = yara 1.3
PACKAGE_TARNAME = yara
PACKAGE_VERSION = 1.2.1
PACKAGE_VERSION = 1.3
PATH_SEPARATOR = :
SET_MAKE =
SHELL = /bin/sh
STRIP =
VERSION = 1.2.1
abs_builddir = /Users/plusvic/Projects/yara
abs_srcdir = /Users/plusvic/Projects/yara
abs_top_builddir = /Users/plusvic/Projects/yara
abs_top_srcdir = /Users/plusvic/Projects/yara
VERSION = 1.3
abs_builddir = /Users/plusvic/Projects/yara/trunk
abs_srcdir = /Users/plusvic/Projects/yara/trunk
abs_top_builddir = /Users/plusvic/Projects/yara/trunk
abs_top_srcdir = /Users/plusvic/Projects/yara/trunk
ac_ct_CC = gcc
am__include = include
am__leading_dot = .
@@ -147,7 +147,7 @@ host_alias =
htmldir = ${docdir}
includedir = ${prefix}/include
infodir = ${datarootdir}/info
install_sh = $(SHELL) /Users/plusvic/Projects/yara/install-sh
install_sh = $(SHELL) /Users/plusvic/Projects/yara/trunk/install-sh
libdir = ${exec_prefix}/lib
libexecdir = ${exec_prefix}/libexec
localedir = ${datarootdir}/locale
config.h
+3 -3
View File
@@ -14,13 +14,13 @@
#define PACKAGE_NAME "yara"
/* Define to the full name and version of this package. */
#define PACKAGE_STRING "yara 1.2.1"
#define PACKAGE_STRING "yara 1.3"
/* Define to the one symbol short name of this package. */
#define PACKAGE_TARNAME "yara"
/* Define to the version of this package. */
#define PACKAGE_VERSION "1.2.1"
#define PACKAGE_VERSION "1.3"
/* Version number of package */
#define VERSION "1.2.1"
#define VERSION "1.3"
configure
Vendored
+10 -10
View File
@@ -1,6 +1,6 @@
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.61 for yara 1.2.1.
# Generated by GNU Autoconf 2.61 for yara 1.3.
#
# Report bugs to <[email protected]>.
#
@@ -574,8 +574,8 @@ SHELL=${CONFIG_SHELL-/bin/sh}
# Identity of this package.
PACKAGE_NAME='yara'
PACKAGE_TARNAME='yara'
PACKAGE_VERSION='1.2.1'
PACKAGE_STRING='yara 1.2.1'
PACKAGE_VERSION='1.3'
PACKAGE_STRING='yara 1.3'
PACKAGE_BUGREPORT='[email protected]'
ac_subst_vars='SHELL
@@ -1167,7 +1167,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
\`configure' configures yara 1.2.1 to adapt to many kinds of systems.
\`configure' configures yara 1.3 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@@ -1233,7 +1233,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
short | recursive ) echo "Configuration of yara 1.2.1:";;
short | recursive ) echo "Configuration of yara 1.3:";;
esac
cat <<\_ACEOF
@@ -1316,7 +1316,7 @@ fi
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
yara configure 1.2.1
yara configure 1.3
generated by GNU Autoconf 2.61
Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1330,7 +1330,7 @@ cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
It was created by yara $as_me 1.2.1, which was
It was created by yara $as_me 1.3, which was
generated by GNU Autoconf 2.61. Invocation command line was
$ $0 $@
@@ -2020,7 +2020,7 @@ fi
# Define the identity of the package.
PACKAGE='yara'
VERSION='1.2.1'
VERSION='1.3'
cat >>confdefs.h <<_ACEOF
@@ -3973,7 +3973,7 @@ exec 6>&1
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
This file was extended by yara $as_me 1.2.1, which was
This file was extended by yara $as_me 1.3, which was
generated by GNU Autoconf 2.61. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@@ -4026,7 +4026,7 @@ Report bugs to <[email protected]>."
_ACEOF
cat >>$CONFIG_STATUS <<_ACEOF
ac_cs_version="\\
yara config.status 1.2.1
yara config.status 1.3
configured by $0, generated by GNU Autoconf 2.61,
with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
configure.ac
+1 -1
View File
@@ -1,4 +1,4 @@
AC_INIT([yara], [1.2.1], [[email protected]])
AC_INIT([yara], [1.3], [[email protected]])
AM_INIT_AUTOMAKE([-Wall -Werror])
AC_PROG_CC
#AC_CHECK_LIB(yara,compile_rules,,AC_MSG_ERROR(yara not found))
extra/TextMate-bundle.zip
BIN
View File
Binary file not shown.
extra/UltraEdit-Wordfile.txt
+2 -1
View File
@@ -13,7 +13,8 @@ condition
entrypoint
for false filesize fullword
global
is in int8 int16 int32
is in include int8 int16 int32
meta
nocase not
or of
private
libyara/Makefile
+29 -22
View File
@@ -31,14 +31,14 @@ POST_INSTALL = :
NORMAL_UNINSTALL = :
PRE_UNINSTALL = :
POST_UNINSTALL = :
build_triplet = i386-apple-darwin10.0.0
host_triplet = i386-apple-darwin10.0.0
build_triplet = i386-apple-darwin9.8.0
host_triplet = i386-apple-darwin9.8.0
subdir = .
DIST_COMMON = README $(am__configure_deps) $(include_HEADERS) \
$(srcdir)/Makefile.am $(srcdir)/Makefile.in \
$(srcdir)/config.h.in $(top_srcdir)/configure config.guess \
config.sub depcomp grammar.c install-sh lex.c ltmain.sh \
missing ylwrap
config.sub depcomp grammar.c grammar.h install-sh lex.c \
ltmain.sh missing ylwrap
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/configure.ac
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
@@ -97,12 +97,12 @@ DIST_ARCHIVES = $(distdir).tar.gz
GZIP_ENV = --best
distuninstallcheck_listfiles = find . -type f -print
distcleancheck_listfiles = find . -type f -print
ACLOCAL = ${SHELL} /Users/plusvic/Projects/yara/libyara/missing --run aclocal-1.10
AMTAR = ${SHELL} /Users/plusvic/Projects/yara/libyara/missing --run tar
ACLOCAL = ${SHELL} /Users/plusvic/Projects/yara/trunk/libyara/missing --run aclocal-1.10
AMTAR = ${SHELL} /Users/plusvic/Projects/yara/trunk/libyara/missing --run tar
AR = ar
AUTOCONF = ${SHELL} /Users/plusvic/Projects/yara/libyara/missing --run autoconf
AUTOHEADER = ${SHELL} /Users/plusvic/Projects/yara/libyara/missing --run autoheader
AUTOMAKE = ${SHELL} /Users/plusvic/Projects/yara/libyara/missing --run automake-1.10
AUTOCONF = ${SHELL} /Users/plusvic/Projects/yara/trunk/libyara/missing --run autoconf
AUTOHEADER = ${SHELL} /Users/plusvic/Projects/yara/trunk/libyara/missing --run autoheader
AUTOMAKE = ${SHELL} /Users/plusvic/Projects/yara/trunk/libyara/missing --run automake-1.10
AWK = awk
CC = gcc
CCDEPMODE = depmode=gcc3
@@ -139,27 +139,27 @@ LIBS = -lpcre -lpcre -lpcre -lpcre
LIBTOOL = $(SHELL) $(top_builddir)/libtool
LN_S = ln -s
LTLIBOBJS =
MAKEINFO = ${SHELL} /Users/plusvic/Projects/yara/libyara/missing --run makeinfo
MAKEINFO = ${SHELL} /Users/plusvic/Projects/yara/trunk/libyara/missing --run makeinfo
MKDIR_P = ./install-sh -c -d
OBJEXT = o
PACKAGE = libyara
PACKAGE_BUGREPORT = [email protected]
PACKAGE_NAME = libyara
PACKAGE_STRING = libyara 1.1.1
PACKAGE_STRING = libyara 1.3
PACKAGE_TARNAME = libyara
PACKAGE_VERSION = 1.1.1
PACKAGE_VERSION = 1.3
PATH_SEPARATOR = :
RANLIB = ranlib
SET_MAKE =
SHELL = /bin/sh
STRIP = strip
VERSION = 1.1.1
VERSION = 1.3
YACC = bison -y
YFLAGS =
abs_builddir = /Users/plusvic/Projects/yara/libyara
abs_srcdir = /Users/plusvic/Projects/yara/libyara
abs_top_builddir = /Users/plusvic/Projects/yara/libyara
abs_top_srcdir = /Users/plusvic/Projects/yara/libyara
abs_builddir = /Users/plusvic/Projects/yara/trunk/libyara
abs_srcdir = /Users/plusvic/Projects/yara/trunk/libyara
abs_top_builddir = /Users/plusvic/Projects/yara/trunk/libyara
abs_top_srcdir = /Users/plusvic/Projects/yara/trunk/libyara
ac_ct_CC = gcc
ac_ct_CXX = g++
ac_ct_F77 =
@@ -169,10 +169,10 @@ am__quote =
am__tar = ${AMTAR} chof - "$$tardir"
am__untar = ${AMTAR} xf -
bindir = ${exec_prefix}/bin
build = i386-apple-darwin10.0.0
build = i386-apple-darwin9.8.0
build_alias =
build_cpu = i386
build_os = darwin10.0.0
build_os = darwin9.8.0
build_vendor = apple
builddir = .
datadir = ${datarootdir}
@@ -180,15 +180,15 @@ datarootdir = ${prefix}/share
docdir = ${datarootdir}/doc/${PACKAGE_TARNAME}
dvidir = ${docdir}
exec_prefix = ${prefix}
host = i386-apple-darwin10.0.0
host = i386-apple-darwin9.8.0
host_alias =
host_cpu = i386
host_os = darwin10.0.0
host_os = darwin9.8.0
host_vendor = apple
htmldir = ${docdir}
includedir = ${prefix}/include
infodir = ${datarootdir}/info
install_sh = $(SHELL) /Users/plusvic/Projects/yara/libyara/install-sh
install_sh = $(SHELL) /Users/plusvic/Projects/yara/trunk/libyara/install-sh
libdir = ${exec_prefix}/lib
libexecdir = ${exec_prefix}/libexec
localedir = ${datarootdir}/locale
@@ -207,6 +207,7 @@ sysconfdir = ${prefix}/etc
target_alias =
top_builddir = .
top_srcdir = .
AM_YFLAGS = -d
include_HEADERS = yara.h
lib_LTLIBRARIES = libyara.la
libyara_la_SOURCES = \
@@ -313,6 +314,11 @@ clean-libLTLIBRARIES:
echo "rm -f \"$${dir}/so_locations\""; \
rm -f "$${dir}/so_locations"; \
done
grammar.h: grammar.c
@if test ! -f $@; then \
rm -f grammar.c; \
$(MAKE) $(AM_MAKEFLAGS) grammar.c; \
else :; fi
libyara.la: $(libyara_la_OBJECTS) $(libyara_la_DEPENDENCIES)
$(LINK) -rpath $(libdir) $(libyara_la_OBJECTS) $(libyara_la_LIBADD) $(LIBS)
@@ -591,6 +597,7 @@ maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@echo "it deletes files that may require special tools to rebuild."
-rm -f grammar.c
-rm -f grammar.h
-rm -f lex.c
clean: clean-am
libyara/Makefile.am
+1 -1
View File
@@ -1,4 +1,4 @@
AM_YFLAGS = -d
include_HEADERS = yara.h
libyara/Makefile.in
+9 -2
View File
@@ -37,8 +37,8 @@ subdir = .
DIST_COMMON = README $(am__configure_deps) $(include_HEADERS) \
$(srcdir)/Makefile.am $(srcdir)/Makefile.in \
$(srcdir)/config.h.in $(top_srcdir)/configure config.guess \
config.sub depcomp grammar.c install-sh lex.c ltmain.sh \
missing ylwrap
config.sub depcomp grammar.c grammar.h install-sh lex.c \
ltmain.sh missing ylwrap
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/configure.ac
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
@@ -207,6 +207,7 @@ sysconfdir = @sysconfdir@
target_alias = @target_alias@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
AM_YFLAGS = -d
include_HEADERS = yara.h
lib_LTLIBRARIES = libyara.la
libyara_la_SOURCES = \
@@ -313,6 +314,11 @@ clean-libLTLIBRARIES:
echo "rm -f \"$${dir}/so_locations\""; \
rm -f "$${dir}/so_locations"; \
done
grammar.h: grammar.c
@if test ! -f $@; then \
rm -f grammar.c; \
$(MAKE) $(AM_MAKEFLAGS) grammar.c; \
else :; fi
libyara.la: $(libyara_la_OBJECTS) $(libyara_la_DEPENDENCIES)
$(LINK) -rpath $(libdir) $(libyara_la_OBJECTS) $(libyara_la_LIBADD) $(LIBS)
@@ -591,6 +597,7 @@ maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@echo "it deletes files that may require special tools to rebuild."
-rm -f grammar.c
-rm -f grammar.h
-rm -f lex.c
clean: clean-am
libyara/ast.c
+20 -1
View File
@@ -43,6 +43,24 @@ RULE* lookup_rule(RULE_LIST* rules, char* identifier, NAMESPACE* namespace)
return NULL;
}
META* lookup_meta(META* meta_list_head, char* identifier)
{
META* meta = meta_list_head;
while (meta != NULL)
{
if (strcmp(meta->identifier, identifier) == 0)
{
return meta;
}
meta = meta->next;
}
return NULL;
}
STRING* lookup_string(STRING* string_list_head, char* identifier)
{
STRING* string = string_list_head;
@@ -115,7 +133,7 @@ int require_exe_file(TERM* term)
}
}
int new_rule(RULE_LIST* rules, char* identifier, NAMESPACE* namespace, int flags, TAG* tag_list_head, STRING* string_list_head, TERM* condition)
int new_rule(RULE_LIST* rules, char* identifier, NAMESPACE* namespace, int flags, TAG* tag_list_head, META* meta_list_head, STRING* string_list_head, TERM* condition)
{
RULE* new_rule;
@@ -131,6 +149,7 @@ int new_rule(RULE_LIST* rules, char* identifier, NAMESPACE* namespace, int flags
new_rule->namespace = namespace;
new_rule->flags = flags;
new_rule->tag_list_head = tag_list_head;
new_rule->meta_list_head = meta_list_head;
new_rule->string_list_head = string_list_head;
new_rule->condition = condition;
new_rule->next = NULL;
libyara/ast.h
+1 -1
View File
@@ -130,7 +130,7 @@ typedef struct _TERM_STRING
int new_rule(RULE_LIST* rules, char* identifier, NAMESPACE* namespace, int flags, TAG* tag_list_head, STRING* string_list_head, TERM* condition);
int new_rule(RULE_LIST* rules, char* identifier, NAMESPACE* namespace, int flags, TAG* tag_list_head, META* meta_list_head, STRING* string_list_head, TERM* condition);
int new_string(YARA_CONTEXT* context, char* identifier, SIZED_STRING* charstr, int flags, STRING** string);
libyara/config.h
+3 -3
View File
@@ -44,19 +44,19 @@
#define PACKAGE_NAME "libyara"
/* Define to the full name and version of this package. */
#define PACKAGE_STRING "libyara 1.1.1"
#define PACKAGE_STRING "libyara 1.3"
/* Define to the one symbol short name of this package. */
#define PACKAGE_TARNAME "libyara"
/* Define to the version of this package. */
#define PACKAGE_VERSION "1.1.1"
#define PACKAGE_VERSION "1.3"
/* Define to 1 if you have the ANSI C header files. */
#define STDC_HEADERS 1
/* Version number of package */
#define VERSION "1.1.1"
#define VERSION "1.3"
/* Define to 1 if `lex' declares `yytext' as a `char *' by default, not a
`char[]'. */
libyara/configure
Vendored
+10 -10
View File
@@ -1,6 +1,6 @@
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.61 for libyara 1.1.1.
# Generated by GNU Autoconf 2.61 for libyara 1.3.
#
# Report bugs to <[email protected]>.
#
@@ -728,8 +728,8 @@ SHELL=${CONFIG_SHELL-/bin/sh}
# Identity of this package.
PACKAGE_NAME='libyara'
PACKAGE_TARNAME='libyara'
PACKAGE_VERSION='1.1.1'
PACKAGE_STRING='libyara 1.1.1'
PACKAGE_VERSION='1.3'
PACKAGE_STRING='libyara 1.3'
PACKAGE_BUGREPORT='[email protected]'
# Factoring default headers for most tests.
@@ -1396,7 +1396,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
\`configure' configures libyara 1.1.1 to adapt to many kinds of systems.
\`configure' configures libyara 1.3 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@@ -1466,7 +1466,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
short | recursive ) echo "Configuration of libyara 1.1.1:";;
short | recursive ) echo "Configuration of libyara 1.3:";;
esac
cat <<\_ACEOF
@@ -1573,7 +1573,7 @@ fi
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
libyara configure 1.1.1
libyara configure 1.3
generated by GNU Autoconf 2.61
Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1587,7 +1587,7 @@ cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
It was created by libyara $as_me 1.1.1, which was
It was created by libyara $as_me 1.3, which was
generated by GNU Autoconf 2.61. Invocation command line was
$ $0 $@
@@ -2277,7 +2277,7 @@ fi
# Define the identity of the package.
PACKAGE='libyara'
VERSION='1.1.1'
VERSION='1.3'
cat >>confdefs.h <<_ACEOF
@@ -20232,7 +20232,7 @@ exec 6>&1
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
This file was extended by libyara $as_me 1.1.1, which was
This file was extended by libyara $as_me 1.3, which was
generated by GNU Autoconf 2.61. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@@ -20285,7 +20285,7 @@ Report bugs to <[email protected]>."
_ACEOF
cat >>$CONFIG_STATUS <<_ACEOF
ac_cs_version="\\
libyara config.status 1.1.1
libyara config.status 1.3
configured by $0, generated by GNU Autoconf 2.61,
with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
libyara/configure.ac
+1 -1
View File
@@ -1,4 +1,4 @@
AC_INIT([libyara], [1.1.1], [[email protected]])
AC_INIT([libyara], [1.3], [[email protected]])
AM_INIT_AUTOMAKE([-Wall -Werror foreign])
AC_PROG_CC
AC_PROG_YACC
libyara/grammar.c
+1110 -1220
View File
File diff suppressed because it is too large Load Diff
libyara/grammar.h
+109 -106
View File
@@ -32,121 +32,123 @@
_RULE_ = 258,
_PRIVATE_ = 259,
_GLOBAL_ = 260,
_STRINGS_ = 261,
_CONDITION_ = 262,
_END_ = 263,
_IDENTIFIER_ = 264,
_STRING_IDENTIFIER_ = 265,
_STRING_COUNT_ = 266,
_STRING_OFFSET_ = 267,
_STRING_IDENTIFIER_WITH_WILDCARD_ = 268,
_ANONYMOUS_STRING_ = 269,
_NUMBER_ = 270,
_UNKNOWN_ = 271,
_TEXTSTRING_ = 272,
_HEXSTRING_ = 273,
_REGEXP_ = 274,
_ASCII_ = 275,
_WIDE_ = 276,
_NOCASE_ = 277,
_FULLWORD_ = 278,
_AT_ = 279,
_SIZE_ = 280,
_ENTRYPOINT_ = 281,
_ALL_ = 282,
_ANY_ = 283,
_RVA_ = 284,
_OFFSET_ = 285,
_FILE_ = 286,
_IN_ = 287,
_OF_ = 288,
_FOR_ = 289,
_THEM_ = 290,
_SECTION_ = 291,
_INT8_ = 292,
_INT16_ = 293,
_INT32_ = 294,
_UINT8_ = 295,
_UINT16_ = 296,
_UINT32_ = 297,
_MZ_ = 298,
_PE_ = 299,
_DLL_ = 300,
_TRUE_ = 301,
_FALSE_ = 302,
_OR_ = 303,
_AND_ = 304,
_NOT_ = 305,
_IS_ = 306,
_NEQ_ = 307,
_EQ_ = 308,
_GE_ = 309,
_GT_ = 310,
_LE_ = 311,
_LT_ = 312
_META_ = 261,
_STRINGS_ = 262,
_CONDITION_ = 263,
_END_ = 264,
_IDENTIFIER_ = 265,
_STRING_IDENTIFIER_ = 266,
_STRING_COUNT_ = 267,
_STRING_OFFSET_ = 268,
_STRING_IDENTIFIER_WITH_WILDCARD_ = 269,
_ANONYMOUS_STRING_ = 270,
_NUMBER_ = 271,
_UNKNOWN_ = 272,
_TEXTSTRING_ = 273,
_HEXSTRING_ = 274,
_REGEXP_ = 275,
_ASCII_ = 276,
_WIDE_ = 277,
_NOCASE_ = 278,
_FULLWORD_ = 279,
_AT_ = 280,
_SIZE_ = 281,
_ENTRYPOINT_ = 282,
_ALL_ = 283,
_ANY_ = 284,
_RVA_ = 285,
_OFFSET_ = 286,
_FILE_ = 287,
_IN_ = 288,
_OF_ = 289,
_FOR_ = 290,
_THEM_ = 291,
_SECTION_ = 292,
_INT8_ = 293,
_INT16_ = 294,
_INT32_ = 295,
_UINT8_ = 296,
_UINT16_ = 297,
_UINT32_ = 298,
_MZ_ = 299,
_PE_ = 300,
_DLL_ = 301,
_TRUE_ = 302,
_FALSE_ = 303,
_OR_ = 304,
_AND_ = 305,
_NOT_ = 306,
_IS_ = 307,
_NEQ_ = 308,
_EQ_ = 309,
_GE_ = 310,
_GT_ = 311,
_LE_ = 312,
_LT_ = 313
};
#endif
#define _RULE_ 258
#define _PRIVATE_ 259
#define _GLOBAL_ 260
#define _STRINGS_ 261
#define _CONDITION_ 262
#define _END_ 263
#define _IDENTIFIER_ 264
#define _STRING_IDENTIFIER_ 265
#define _STRING_COUNT_ 266
#define _STRING_OFFSET_ 267
#define _STRING_IDENTIFIER_WITH_WILDCARD_ 268
#define _ANONYMOUS_STRING_ 269
#define _NUMBER_ 270
#define _UNKNOWN_ 271
#define _TEXTSTRING_ 272
#define _HEXSTRING_ 273
#define _REGEXP_ 274
#define _ASCII_ 275
#define _WIDE_ 276
#define _NOCASE_ 277
#define _FULLWORD_ 278
#define _AT_ 279
#define _SIZE_ 280
#define _ENTRYPOINT_ 281
#define _ALL_ 282
#define _ANY_ 283
#define _RVA_ 284
#define _OFFSET_ 285
#define _FILE_ 286
#define _IN_ 287
#define _OF_ 288
#define _FOR_ 289
#define _THEM_ 290
#define _SECTION_ 291
#define _INT8_ 292
#define _INT16_ 293
#define _INT32_ 294
#define _UINT8_ 295
#define _UINT16_ 296
#define _UINT32_ 297
#define _MZ_ 298
#define _PE_ 299
#define _DLL_ 300
#define _TRUE_ 301
#define _FALSE_ 302
#define _OR_ 303
#define _AND_ 304
#define _NOT_ 305
#define _IS_ 306
#define _NEQ_ 307
#define _EQ_ 308
#define _GE_ 309
#define _GT_ 310
#define _LE_ 311
#define _LT_ 312
#define _META_ 261
#define _STRINGS_ 262
#define _CONDITION_ 263
#define _END_ 264
#define _IDENTIFIER_ 265
#define _STRING_IDENTIFIER_ 266
#define _STRING_COUNT_ 267
#define _STRING_OFFSET_ 268
#define _STRING_IDENTIFIER_WITH_WILDCARD_ 269
#define _ANONYMOUS_STRING_ 270
#define _NUMBER_ 271
#define _UNKNOWN_ 272
#define _TEXTSTRING_ 273
#define _HEXSTRING_ 274
#define _REGEXP_ 275
#define _ASCII_ 276
#define _WIDE_ 277
#define _NOCASE_ 278
#define _FULLWORD_ 279
#define _AT_ 280
#define _SIZE_ 281
#define _ENTRYPOINT_ 282
#define _ALL_ 283
#define _ANY_ 284
#define _RVA_ 285
#define _OFFSET_ 286
#define _FILE_ 287
#define _IN_ 288
#define _OF_ 289
#define _FOR_ 290
#define _THEM_ 291
#define _SECTION_ 292
#define _INT8_ 293
#define _INT16_ 294
#define _INT32_ 295
#define _UINT8_ 296
#define _UINT16_ 297
#define _UINT32_ 298
#define _MZ_ 299
#define _PE_ 300
#define _DLL_ 301
#define _TRUE_ 302
#define _FALSE_ 303
#define _OR_ 304
#define _AND_ 305
#define _NOT_ 306
#define _IS_ 307
#define _NEQ_ 308
#define _EQ_ 309
#define _GE_ 310
#define _GT_ 311
#define _LE_ 312
#define _LT_ 313
#if ! defined (YYSTYPE) && ! defined (YYSTYPE_IS_DECLARED)
#line 97 "grammar.y"
#line 104 "grammar.y"
typedef union YYSTYPE {
void* sized_string;
@@ -155,10 +157,11 @@ typedef union YYSTYPE {
void* string;
void* term;
void* tag;
void* meta;
} YYSTYPE;
/* Line 1318 of yacc.c. */
#line 162 "grammar.h"
#line 165 "grammar.h"
# define yystype YYSTYPE /* obsolescent; will be withdrawn */
# define YYSTYPE_IS_DECLARED 1
# define YYSTYPE_IS_TRIVIAL 1
libyara/grammar.y
+179 -31
View File
@@ -22,6 +22,7 @@
%token _RULE_
%token _PRIVATE_
%token _GLOBAL_
%token _META_
%token <string> _STRINGS_
%token _CONDITION_
%token _END_
@@ -77,6 +78,11 @@
%type <string> strings
%type <string> string_declaration
%type <string> string_declarations
%type <meta> meta
%type <meta> meta_declaration
%type <meta> meta_declarations
%type <integer> string_modifier
%type <integer> string_modifiers
@@ -93,6 +99,7 @@
%type <term> string_set
%type <term> string_enumeration
%type <term> string_enumeration_item
%type <term> condition
%union {
@@ -102,6 +109,7 @@
void* string;
void* term;
void* tag;
void* meta;
}
@@ -116,12 +124,23 @@ int reduce_rule_declaration( yyscan_t yyscanner,
char* identifier,
int flags,
TAG* tag_list_head,
META* meta_list_head,
STRING* string_list_head,
TERM* condition);
TAG* reduce_tags( yyscan_t yyscanner,
TAG* tag_list_head,
char* identifier);
META* reduce_meta_declaration( yyscan_t yyscanner,
int type,
char* identifier,
unsigned int value);
META* reduce_metas( yyscan_t yyscanner,
META* meta_list_head,
META* meta);
STRING* reduce_string_declaration( yyscan_t yyscanner,
char* identifier,
@@ -189,17 +208,9 @@ rules : /* empty */
| rules error 'include' /* .. or include statement */
;
rule : rule_modifiers _RULE_ _IDENTIFIER_ tags '{' _CONDITION_ ':' boolean_expression '}'
rule : rule_modifiers _RULE_ _IDENTIFIER_ tags '{' meta strings condition '}'
{
if (reduce_rule_declaration(yyscanner, $3,$1,$4,0,$8) != ERROR_SUCCESS)
{
yyerror(yyscanner, NULL);
YYERROR;
}
}
| rule_modifiers _RULE_ _IDENTIFIER_ tags '{' _STRINGS_ ':' strings _CONDITION_ ':' boolean_expression '}'
{
if (reduce_rule_declaration(yyscanner, $3,$1,$4,$8,$11) != ERROR_SUCCESS)
if (reduce_rule_declaration(yyscanner, $3,$1,$4,$6,$7,$8) != ERROR_SUCCESS)
{
yyerror(yyscanner, NULL);
YYERROR;
@@ -207,6 +218,17 @@ rule : rule_modifiers _RULE_ _IDENTIFIER_ tags '{' _CONDITION_ ':' boolean_
}
;
meta : /* empty */ { $$ = NULL; }
| _META_ ':' meta_declarations { $$ = $3; }
;
strings : /* empty */ { $$ = NULL; }
| _STRINGS_ ':' string_declarations { $$ = $3; }
;
condition : _CONDITION_ ':' boolean_expression { $$ = $3; }
;
rule_modifiers : /* empty */ { $$ = 0; }
| rule_modifiers rule_modifier { $$ = $1 | $2; }
;
@@ -238,26 +260,85 @@ tag_list : _IDENTIFIER_ {
}
}
meta_declarations : meta_declaration {
$$ = reduce_metas(yyscanner, NULL, $1);
if ($$ == NULL)
{
yyerror(yyscanner, NULL);
YYERROR;
}
}
| meta_declarations meta_declaration {
$$ = reduce_metas(yyscanner, $1, $2);
if ($$ == NULL)
{
yyerror(yyscanner, NULL);
YYERROR;
}
}
;
meta_declaration : _IDENTIFIER_ '=' _TEXTSTRING_ {
$$ = reduce_meta_declaration(yyscanner, META_TYPE_STRING, $1, (unsigned int) $3);
if ($$ == NULL)
{
yyerror(yyscanner, NULL);
YYERROR;
}
}
| _IDENTIFIER_ '=' _NUMBER_ {
$$ = reduce_meta_declaration(yyscanner, META_TYPE_INTEGER, $1, $3);
if ($$ == NULL)
{
yyerror(yyscanner, NULL);
YYERROR;
}
}
| _IDENTIFIER_ '=' _TRUE_ {
$$ = reduce_meta_declaration(yyscanner, META_TYPE_BOOLEAN, $1, TRUE);
if ($$ == NULL)
{
yyerror(yyscanner, NULL);
YYERROR;
}
}
| _IDENTIFIER_ '=' _FALSE_ {
$$ = reduce_meta_declaration(yyscanner, META_TYPE_BOOLEAN, $1, FALSE);
if ($$ == NULL)
{
yyerror(yyscanner, NULL);
YYERROR;
}
}
;
strings : string_declaration {
$$ = reduce_strings(yyscanner,NULL,$1);
if ($$ == NULL)
{
yyerror(yyscanner, NULL);
YYERROR;
}
}
| strings string_declaration {
$$ = reduce_strings(yyscanner,$1,$2);
if ($$ == NULL)
{
yyerror(yyscanner, NULL);
YYERROR;
}
}
;
string_declarations : string_declaration
{
$$ = reduce_strings(yyscanner,NULL,$1);
if ($$ == NULL)
{
yyerror(yyscanner, NULL);
YYERROR;
}
}
| string_declarations string_declaration
{
$$ = reduce_strings(yyscanner,$1,$2);
if ($$ == NULL)
{
yyerror(yyscanner, NULL);
YYERROR;
}
}
;
string_declaration : _STRING_IDENTIFIER_ '=' _TEXTSTRING_ string_modifiers
{
@@ -548,7 +629,8 @@ int count_strings(TERM_STRING* st)
int reduce_rule_declaration( yyscan_t yyscanner,
char* identifier,
int flags,
TAG* tag_list_head,
TAG* tag_list_head,
META* meta_list_head,
STRING* string_list_head,
TERM* condition
)
@@ -556,7 +638,14 @@ int reduce_rule_declaration( yyscan_t yyscanner,
STRING* string;
YARA_CONTEXT* context = yyget_extra(yyscanner);
context->last_result = new_rule(&context->rule_list, identifier, context->current_namespace, flags, tag_list_head, string_list_head, condition);
context->last_result = new_rule(&context->rule_list,
identifier,
context->current_namespace,
flags,
tag_list_head,
meta_list_head,
string_list_head,
condition);
if (context->last_result != ERROR_SUCCESS)
{
@@ -636,6 +725,65 @@ STRING* reduce_strings( yyscan_t yyscanner,
}
}
META* reduce_meta_declaration( yyscan_t yyscanner,
int type,
char* identifier,
unsigned int value)
{
META* meta = NULL;
YARA_CONTEXT* context = yyget_extra(yyscanner);
meta = yr_malloc(sizeof(META));
if (meta != NULL)
{
meta->identifier = identifier;
meta->type = type;
if (type == META_TYPE_INTEGER)
{
meta->integer = value;
}
else if (type == META_TYPE_BOOLEAN)
{
meta->boolean = value;
}
else
{
meta->string = yr_strdup(((SIZED_STRING*) value)->c_string);
yr_free((SIZED_STRING*) value);
}
}
else
{
context->last_result = ERROR_INSUFICIENT_MEMORY;
}
return meta;
}
META* reduce_metas( yyscan_t yyscanner,
META* meta_list_head,
META* meta)
{
YARA_CONTEXT* context = yyget_extra(yyscanner);
/* no metas with the same identifier */
if (lookup_meta(meta_list_head, meta->identifier) == NULL)
{
meta->next = meta_list_head;
context->last_result = ERROR_SUCCESS;
return meta;
}
else
{
strncpy(context->last_error_extra_info, meta->identifier, sizeof(context->last_error_extra_info));
context->last_result = ERROR_DUPLICATE_META_IDENTIFIER;
return NULL;
}
}
TAG* reduce_tags( yyscan_t yyscanner,
TAG* tag_list_head,
char* identifier)
libyara/lex.c
+260 -255
View File
@@ -367,8 +367,8 @@ static void yy_fatal_error (yyconst char msg[] ,yyscan_t yyscanner );
*yy_cp = '\0'; \
yyg->yy_c_buf_p = yy_cp;
#define YY_NUM_RULES 71
#define YY_END_OF_BUFFER 72
#define YY_NUM_RULES 72
#define YY_END_OF_BUFFER 73
/* This struct is not used in this scanner,
but its presence is necessary. */
struct yy_trans_info
@@ -376,31 +376,31 @@ struct yy_trans_info
flex_int32_t yy_verify;
flex_int32_t yy_nxt;
};
static yyconst flex_int16_t yy_accept[205] =
static yyconst flex_int16_t yy_accept[209] =
{ 0,
0, 0, 0, 0, 0, 0, 0, 0, 72, 70,
69, 69, 70, 66, 48, 47, 67, 51, 51, 1,
70, 2, 49, 50, 50, 50, 50, 50, 50, 50,
50, 50, 50, 50, 50, 50, 50, 50, 70, 58,
59, 53, 71, 64, 65, 61, 71, 44, 45, 6,
48, 46, 47, 0, 42, 51, 0, 0, 0, 3,
5, 4, 49, 50, 50, 50, 50, 21, 50, 50,
50, 50, 50, 50, 50, 22, 33, 50, 23, 20,
50, 50, 50, 50, 50, 50, 50, 50, 50, 0,
58, 60, 55, 56, 54, 60, 64, 63, 62, 44,
0, 0, 0, 0, 0, 0, 0, 0, 73, 71,
70, 70, 71, 67, 49, 48, 68, 52, 52, 1,
71, 2, 50, 51, 51, 51, 51, 51, 51, 51,
51, 51, 51, 51, 51, 51, 51, 51, 51, 71,
59, 60, 54, 72, 65, 66, 62, 72, 45, 46,
6, 49, 47, 48, 0, 43, 52, 0, 0, 0,
3, 5, 4, 50, 51, 51, 51, 51, 22, 51,
51, 51, 51, 51, 51, 51, 23, 34, 51, 51,
24, 21, 51, 51, 51, 51, 51, 51, 51, 51,
51, 0, 59, 61, 56, 57, 55, 61, 65, 64,
0, 0, 42, 51, 52, 26, 19, 27, 50, 50,
50, 50, 50, 25, 50, 50, 50, 50, 50, 18,
50, 50, 50, 30, 50, 50, 50, 50, 50, 50,
68, 0, 41, 50, 50, 50, 50, 32, 50, 50,
50, 50, 50, 38, 50, 50, 50, 9, 50, 50,
24, 16, 50, 12, 57, 11, 50, 50, 17, 50,
50, 50, 50, 39, 40, 50, 50, 50, 50, 50,
50, 50, 35, 50, 50, 50, 50, 8, 50, 14,
31, 50, 50, 50, 36, 37, 50, 50, 50, 50,
50, 7, 34, 10, 50, 50, 29, 13, 0, 15,
63, 45, 0, 0, 43, 52, 53, 27, 20, 28,
51, 51, 51, 51, 51, 26, 51, 51, 51, 51,
51, 51, 19, 51, 51, 51, 31, 51, 51, 51,
51, 51, 51, 69, 0, 42, 51, 51, 51, 51,
33, 51, 51, 51, 51, 51, 39, 10, 51, 51,
51, 9, 51, 51, 25, 17, 51, 13, 58, 12,
51, 51, 18, 51, 51, 51, 51, 40, 41, 51,
51, 51, 51, 51, 51, 51, 36, 51, 51, 51,
51, 8, 51, 15, 32, 51, 51, 51, 37, 38,
51, 51, 51, 51, 51, 7, 35, 11, 51, 51,
50, 43, 28, 0
30, 14, 0, 16, 51, 44, 29, 0
} ;
static yyconst flex_int32_t yy_ec[256] =
@@ -445,114 +445,114 @@ static yyconst flex_int32_t yy_meta[56] =
10, 9, 9, 1, 1
} ;
static yyconst flex_int16_t yy_base[224] =
static yyconst flex_int16_t yy_base[228] =
{ 0,
0, 0, 53, 54, 55, 56, 339, 338, 344, 347,
347, 347, 322, 347, 0, 331, 51, 37, 42, 320,
319, 318, 0, 0, 31, 295, 295, 48, 296, 30,
292, 30, 289, 32, 39, 52, 294, 293, 0, 0,
347, 347, 82, 0, 347, 347, 319, 0, 347, 347,
0, 347, 319, 318, 0, 0, 303, 302, 0, 347,
347, 347, 0, 0, 286, 58, 292, 0, 282, 276,
282, 281, 275, 279, 275, 61, 0, 62, 281, 0,
277, 275, 283, 280, 267, 276, 262, 267, 274, 252,
0, 347, 347, 347, 347, 0, 0, 347, 347, 0,
0, 0, 53, 54, 55, 56, 342, 341, 347, 350,
350, 350, 325, 350, 0, 334, 51, 37, 42, 323,
322, 321, 0, 0, 31, 298, 298, 48, 299, 30,
303, 294, 30, 291, 32, 39, 52, 296, 295, 0,
0, 350, 350, 82, 0, 350, 350, 321, 0, 350,
350, 0, 350, 321, 320, 0, 0, 305, 304, 0,
350, 350, 350, 0, 0, 288, 58, 294, 0, 284,
278, 284, 283, 277, 281, 277, 61, 0, 272, 62,
282, 0, 278, 276, 284, 281, 268, 277, 263, 268,
275, 253, 0, 350, 350, 350, 350, 0, 0, 350,
295, 293, 0, 347, 0, 0, 0, 0, 265, 269,
257, 255, 265, 0, 259, 266, 257, 84, 265, 0,
249, 245, 258, 0, 245, 252, 249, 254, 241, 252,
347, 0, 347, 247, 246, 232, 248, 236, 231, 249,
231, 260, 262, 0, 230, 225, 209, 0, 188, 179,
0, 0, 85, 0, 347, 0, 170, 154, 0, 157,
149, 151, 156, 0, 0, 144, 131, 125, 89, 94,
112, 113, 0, 88, 83, 72, 79, 0, 88, 0,
0, 87, 79, 74, 0, 0, 76, 79, 81, 80,
100, 0, 0, 0, 71, 65, 0, 0, 110, 0,
350, 0, 296, 294, 0, 350, 0, 0, 0, 0,
266, 270, 258, 256, 266, 0, 260, 267, 258, 84,
266, 265, 0, 249, 245, 258, 0, 245, 252, 249,
254, 241, 252, 350, 0, 350, 247, 246, 232, 248,
236, 231, 249, 231, 260, 262, 0, 0, 230, 225,
209, 0, 188, 179, 0, 0, 85, 0, 350, 0,
170, 154, 0, 157, 149, 151, 156, 0, 0, 144,
131, 125, 89, 94, 112, 113, 0, 88, 83, 72,
79, 0, 88, 0, 0, 87, 79, 74, 0, 0,
76, 79, 81, 80, 100, 0, 0, 0, 71, 65,
59, 347, 0, 347, 133, 144, 155, 160, 166, 170,
174, 178, 186, 194, 204, 215, 225, 236, 247, 258,
263, 265, 267
0, 0, 110, 0, 59, 350, 0, 350, 133, 144,
155, 160, 166, 170, 174, 178, 186, 194, 204, 215,
225, 236, 247, 258, 263, 265, 267
} ;
static yyconst flex_int16_t yy_def[224] =
static yyconst flex_int16_t yy_def[228] =
{ 0,
204, 1, 205, 205, 206, 206, 207, 207, 204, 204,
204, 204, 204, 204, 208, 209, 204, 210, 210, 204,
204, 204, 211, 212, 212, 212, 212, 212, 212, 212,
212, 212, 212, 212, 212, 212, 212, 212, 213, 214,
204, 204, 215, 216, 204, 204, 217, 218, 204, 204,
208, 204, 209, 219, 220, 19, 204, 204, 221, 204,
204, 204, 211, 212, 212, 212, 212, 212, 212, 212,
212, 212, 212, 212, 212, 212, 212, 212, 212, 212,
212, 212, 212, 212, 212, 212, 212, 212, 212, 213,
214, 204, 204, 204, 204, 222, 216, 204, 204, 218,
208, 1, 209, 209, 210, 210, 211, 211, 208, 208,
208, 208, 208, 208, 212, 213, 208, 214, 214, 208,
208, 208, 215, 216, 216, 216, 216, 216, 216, 216,
216, 216, 216, 216, 216, 216, 216, 216, 216, 217,
218, 208, 208, 219, 220, 208, 208, 221, 222, 208,
208, 212, 208, 213, 223, 224, 19, 208, 208, 225,
208, 208, 208, 215, 216, 216, 216, 216, 216, 216,
216, 216, 216, 216, 216, 216, 216, 216, 216, 216,
216, 216, 216, 216, 216, 216, 216, 216, 216, 216,
216, 217, 218, 208, 208, 208, 208, 226, 220, 208,
219, 219, 220, 204, 221, 212, 212, 212, 212, 212,
212, 212, 212, 212, 212, 212, 212, 212, 212, 212,
212, 212, 212, 212, 212, 212, 212, 212, 212, 212,
204, 223, 204, 212, 212, 212, 212, 212, 212, 212,
212, 212, 212, 212, 212, 212, 212, 212, 212, 212,
212, 212, 212, 212, 204, 212, 212, 212, 212, 212,
212, 212, 212, 212, 212, 212, 212, 212, 212, 212,
212, 212, 212, 212, 212, 212, 212, 212, 212, 212,
212, 212, 212, 212, 212, 212, 212, 212, 212, 212,
212, 212, 212, 212, 212, 212, 212, 212, 204, 212,
208, 222, 223, 223, 224, 208, 225, 216, 216, 216,
216, 216, 216, 216, 216, 216, 216, 216, 216, 216,
216, 216, 216, 216, 216, 216, 216, 216, 216, 216,
216, 216, 216, 208, 227, 208, 216, 216, 216, 216,
216, 216, 216, 216, 216, 216, 216, 216, 216, 216,
216, 216, 216, 216, 216, 216, 216, 216, 208, 216,
216, 216, 216, 216, 216, 216, 216, 216, 216, 216,
216, 216, 216, 216, 216, 216, 216, 216, 216, 216,
216, 216, 216, 216, 216, 216, 216, 216, 216, 216,
216, 216, 216, 216, 216, 216, 216, 216, 216, 216,
212, 204, 212, 0, 204, 204, 204, 204, 204, 204,
204, 204, 204, 204, 204, 204, 204, 204, 204, 204,
204, 204, 204
216, 216, 208, 216, 216, 208, 216, 0, 208, 208,
208, 208, 208, 208, 208, 208, 208, 208, 208, 208,
208, 208, 208, 208, 208, 208, 208
} ;
static yyconst flex_int16_t yy_nxt[403] =
static yyconst flex_int16_t yy_nxt[406] =
{ 0,
10, 11, 12, 11, 11, 13, 14, 15, 16, 10,
10, 17, 18, 19, 19, 19, 19, 19, 19, 20,
21, 22, 23, 24, 24, 24, 24, 24, 10, 24,
25, 24, 26, 24, 27, 28, 29, 24, 30, 24,
24, 31, 32, 33, 34, 35, 36, 37, 24, 38,
24, 24, 24, 39, 10, 41, 41, 45, 45, 42,
42, 54, 55, 57, 58, 79, 46, 46, 57, 58,
65, 76, 66, 84, 80, 77, 67, 68, 71, 82,
83, 43, 43, 47, 47, 85, 72, 59, 93, 86,
73, 107, 204, 117, 119, 74, 87, 142, 171, 143,
31, 32, 33, 34, 35, 36, 37, 38, 24, 39,
24, 24, 24, 40, 10, 42, 42, 46, 46, 43,
43, 55, 56, 58, 59, 81, 47, 47, 58, 59,
66, 77, 67, 86, 82, 78, 68, 69, 72, 84,
85, 44, 44, 48, 48, 87, 73, 60, 95, 88,
74, 109, 208, 119, 122, 75, 89, 145, 175, 146,
172, 199, 144, 173, 199, 203, 201, 118, 120, 108,
94, 199, 200, 198, 199, 197, 202, 196, 195, 194,
193, 192, 191, 190, 189, 188, 187, 186, 95, 185,
184, 183, 96, 40, 40, 40, 40, 40, 40, 40,
40, 40, 40, 40, 44, 44, 44, 44, 44, 44,
44, 44, 44, 44, 44, 48, 48, 48, 48, 48,
48, 48, 48, 48, 48, 48, 51, 51, 51, 51,
53, 182, 53, 53, 53, 53, 56, 181, 180, 56,
63, 63, 63, 63, 64, 64, 64, 64, 90, 179,
178, 177, 90, 90, 91, 176, 91, 175, 91, 91,
176, 203, 147, 177, 203, 207, 205, 120, 123, 110,
96, 203, 204, 202, 203, 201, 206, 200, 199, 198,
197, 196, 195, 194, 193, 192, 191, 190, 97, 189,
188, 187, 98, 41, 41, 41, 41, 41, 41, 41,
41, 41, 41, 41, 45, 45, 45, 45, 45, 45,
45, 45, 45, 45, 45, 49, 49, 49, 49, 49,
49, 49, 49, 49, 49, 49, 52, 52, 52, 52,
54, 186, 54, 54, 54, 54, 57, 185, 184, 57,
64, 64, 64, 64, 65, 65, 65, 65, 92, 183,
182, 181, 92, 92, 93, 180, 93, 179, 93, 93,
91, 91, 91, 91, 92, 92, 92, 92, 92, 92,
92, 92, 92, 92, 92, 97, 174, 97, 97, 97,
170, 97, 97, 97, 97, 98, 169, 98, 98, 98,
98, 98, 98, 98, 98, 98, 100, 100, 100, 168,
100, 100, 100, 100, 100, 100, 100, 101, 101, 101,
101, 101, 101, 101, 101, 101, 101, 101, 103, 167,
103, 103, 103, 103, 103, 103, 103, 103, 103, 105,
105, 132, 132, 155, 155, 166, 165, 164, 163, 162,
161, 160, 159, 158, 157, 156, 154, 153, 152, 151,
150, 149, 148, 147, 146, 145, 141, 140, 139, 138,
93, 93, 93, 93, 94, 94, 94, 94, 94, 94,
94, 94, 94, 94, 94, 99, 178, 99, 99, 99,
174, 99, 99, 99, 99, 100, 173, 100, 100, 100,
100, 100, 100, 100, 100, 100, 102, 102, 102, 172,
102, 102, 102, 102, 102, 102, 102, 103, 103, 103,
103, 103, 103, 103, 103, 103, 103, 103, 105, 171,
105, 105, 105, 105, 105, 105, 105, 105, 105, 107,
107, 135, 135, 159, 159, 170, 169, 168, 167, 166,
165, 164, 163, 162, 161, 160, 158, 157, 156, 155,
154, 153, 152, 151, 150, 149, 148, 144, 143, 142,
137, 136, 135, 134, 133, 102, 131, 130, 129, 128,
127, 126, 125, 124, 123, 122, 121, 116, 115, 114,
113, 112, 111, 110, 109, 106, 104, 104, 102, 52,
99, 89, 88, 81, 78, 75, 70, 69, 62, 61,
60, 52, 50, 204, 49, 49, 9, 204, 204, 204,
204, 204, 204, 204, 204, 204, 204, 204, 204, 204,
204, 204, 204, 204, 204, 204, 204, 204, 204, 204,
204, 204, 204, 204, 204, 204, 204, 204, 204, 204,
204, 204, 204, 204, 204, 204, 204, 204, 204, 204,
204, 204, 204, 204, 204, 204, 204, 204, 204, 204,
141, 140, 139, 138, 137, 136, 104, 134, 133, 132,
131, 130, 129, 128, 127, 126, 125, 124, 121, 118,
117, 116, 115, 114, 113, 112, 111, 108, 106, 106,
104, 53, 101, 91, 90, 83, 80, 79, 76, 71,
70, 63, 62, 61, 53, 51, 208, 50, 50, 9,
208, 208, 208, 208, 208, 208, 208, 208, 208, 208,
208, 208, 208, 208, 208, 208, 208, 208, 208, 208,
208, 208, 208, 208, 208, 208, 208, 208, 208, 208,
208, 208, 208, 208, 208, 208, 208, 208, 208, 208,
208, 208, 208, 208, 208, 208, 208, 208, 208, 208,
204, 204
208, 208, 208, 208, 208
} ;
static yyconst flex_int16_t yy_chk[403] =
static yyconst flex_int16_t yy_chk[406] =
{ 0,
1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
@@ -560,54 +560,54 @@ static yyconst flex_int16_t yy_chk[403] =
1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 3, 4, 5, 6, 3,
4, 17, 17, 18, 18, 32, 5, 6, 19, 19,
25, 30, 25, 35, 32, 30, 25, 25, 28, 34,
34, 3, 4, 5, 6, 35, 28, 18, 43, 36,
28, 66, 19, 76, 78, 28, 36, 118, 153, 118,
4, 17, 17, 18, 18, 33, 5, 6, 19, 19,
25, 30, 25, 36, 33, 30, 25, 25, 28, 35,
35, 3, 4, 5, 6, 36, 28, 18, 44, 37,
28, 67, 19, 77, 80, 28, 37, 120, 157, 120,
153, 191, 118, 153, 191, 201, 196, 76, 78, 66,
43, 199, 195, 190, 199, 189, 199, 188, 187, 184,
183, 182, 179, 177, 176, 175, 174, 172, 43, 171,
170, 169, 43, 205, 205, 205, 205, 205, 205, 205,
205, 205, 205, 205, 206, 206, 206, 206, 206, 206,
206, 206, 206, 206, 206, 207, 207, 207, 207, 207,
207, 207, 207, 207, 207, 207, 208, 208, 208, 208,
209, 168, 209, 209, 209, 209, 210, 167, 166, 210,
211, 211, 211, 211, 212, 212, 212, 212, 213, 163,
162, 161, 213, 213, 214, 160, 214, 158, 214, 214,
157, 195, 120, 157, 195, 205, 200, 77, 80, 67,
44, 203, 199, 194, 203, 193, 203, 192, 191, 188,
187, 186, 183, 181, 180, 179, 178, 176, 44, 175,
174, 173, 44, 209, 209, 209, 209, 209, 209, 209,
209, 209, 209, 209, 210, 210, 210, 210, 210, 210,
210, 210, 210, 210, 210, 211, 211, 211, 211, 211,
211, 211, 211, 211, 211, 211, 212, 212, 212, 212,
213, 172, 213, 213, 213, 213, 214, 171, 170, 214,
215, 215, 215, 215, 216, 216, 216, 216, 217, 167,
166, 165, 217, 217, 218, 164, 218, 162, 218, 218,
214, 214, 214, 214, 215, 215, 215, 215, 215, 215,
215, 215, 215, 215, 215, 216, 157, 216, 216, 216,
150, 216, 216, 216, 216, 217, 149, 217, 217, 217,
217, 217, 217, 217, 217, 217, 218, 218, 218, 147,
218, 218, 218, 218, 218, 218, 218, 219, 219, 219,
219, 219, 219, 219, 219, 219, 219, 219, 220, 146,
220, 220, 220, 220, 220, 220, 220, 220, 220, 221,
221, 222, 222, 223, 223, 145, 143, 142, 141, 140,
139, 138, 137, 136, 135, 134, 130, 129, 128, 127,
126, 125, 123, 122, 121, 119, 117, 116, 115, 113,
218, 218, 218, 218, 219, 219, 219, 219, 219, 219,
219, 219, 219, 219, 219, 220, 161, 220, 220, 220,
154, 220, 220, 220, 220, 221, 153, 221, 221, 221,
221, 221, 221, 221, 221, 221, 222, 222, 222, 151,
222, 222, 222, 222, 222, 222, 222, 223, 223, 223,
223, 223, 223, 223, 223, 223, 223, 223, 224, 150,
224, 224, 224, 224, 224, 224, 224, 224, 224, 225,
225, 226, 226, 227, 227, 149, 146, 145, 144, 143,
142, 141, 140, 139, 138, 137, 133, 132, 131, 130,
129, 128, 126, 125, 124, 122, 121, 119, 118, 117,
112, 111, 110, 109, 102, 101, 90, 89, 88, 87,
86, 85, 84, 83, 82, 81, 79, 75, 74, 73,
72, 71, 70, 69, 67, 65, 58, 57, 54, 53,
47, 38, 37, 33, 31, 29, 27, 26, 22, 21,
20, 16, 13, 9, 8, 7, 204, 204, 204, 204,
204, 204, 204, 204, 204, 204, 204, 204, 204, 204,
204, 204, 204, 204, 204, 204, 204, 204, 204, 204,
204, 204, 204, 204, 204, 204, 204, 204, 204, 204,
204, 204, 204, 204, 204, 204, 204, 204, 204, 204,
204, 204, 204, 204, 204, 204, 204, 204, 204, 204,
115, 114, 113, 112, 111, 104, 103, 92, 91, 90,
89, 88, 87, 86, 85, 84, 83, 81, 79, 76,
75, 74, 73, 72, 71, 70, 68, 66, 59, 58,
55, 54, 48, 39, 38, 34, 32, 31, 29, 27,
26, 22, 21, 20, 16, 13, 9, 8, 7, 208,
208, 208, 208, 208, 208, 208, 208, 208, 208, 208,
208, 208, 208, 208, 208, 208, 208, 208, 208, 208,
208, 208, 208, 208, 208, 208, 208, 208, 208, 208,
208, 208, 208, 208, 208, 208, 208, 208, 208, 208,
208, 208, 208, 208, 208, 208, 208, 208, 208, 208,
204, 204
208, 208, 208, 208, 208
} ;
/* Table of booleans, true if rule could match eol. */
static yyconst flex_int32_t yy_rule_can_match_eol[72] =
static yyconst flex_int32_t yy_rule_can_match_eol[73] =
{ 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1,
1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, };
0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, };
/* The intent behind this definition is that it'll catch
* any uses of REJECT which flex missed.
@@ -935,13 +935,13 @@ yy_match:
while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
{
yy_current_state = (int) yy_def[yy_current_state];
if ( yy_current_state >= 205 )
if ( yy_current_state >= 209 )
yy_c = yy_meta[(unsigned int) yy_c];
}
yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
++yy_cp;
}
while ( yy_base[yy_current_state] != 347 );
while ( yy_base[yy_current_state] != 350 );
yy_find_action:
yy_act = yy_accept[yy_current_state];
@@ -1025,189 +1025,194 @@ YY_RULE_SETUP
case 10:
YY_RULE_SETUP
#line 58 "lex.l"
{ return _STRINGS_; }
{ return _META_; }
YY_BREAK
case 11:
YY_RULE_SETUP
#line 59 "lex.l"
{ return _ASCII_; }
{ return _STRINGS_; }
YY_BREAK
case 12:
YY_RULE_SETUP
#line 60 "lex.l"
{ return _WIDE_; }
{ return _ASCII_; }
YY_BREAK
case 13:
YY_RULE_SETUP
#line 61 "lex.l"
{ return _FULLWORD_; }
{ return _WIDE_; }
YY_BREAK
case 14:
YY_RULE_SETUP
#line 62 "lex.l"
{ return _NOCASE_; }
{ return _FULLWORD_; }
YY_BREAK
case 15:
YY_RULE_SETUP
#line 63 "lex.l"
{ return _CONDITION_; }
{ return _NOCASE_; }
YY_BREAK
case 16:
YY_RULE_SETUP
#line 64 "lex.l"
{ return _TRUE_; }
{ return _CONDITION_; }
YY_BREAK
case 17:
YY_RULE_SETUP
#line 65 "lex.l"
{ return _FALSE_; }
{ return _TRUE_; }
YY_BREAK
case 18:
YY_RULE_SETUP
#line 66 "lex.l"
{ return _NOT_; }
{ return _FALSE_; }
YY_BREAK
case 19:
YY_RULE_SETUP
#line 67 "lex.l"
{ return _AND_; }
{ return _NOT_; }
YY_BREAK
case 20:
YY_RULE_SETUP
#line 68 "lex.l"
{ return _OR_; }
{ return _AND_; }
YY_BREAK
case 21:
YY_RULE_SETUP
#line 69 "lex.l"
{ return _AT_; }
{ return _OR_; }
YY_BREAK
case 22:
YY_RULE_SETUP
#line 70 "lex.l"
{ return _IN_; }
{ return _AT_; }
YY_BREAK
case 23:
YY_RULE_SETUP
#line 71 "lex.l"
{ return _OF_; }
{ return _IN_; }
YY_BREAK
case 24:
YY_RULE_SETUP
#line 72 "lex.l"
{ return _THEM_; }
{ return _OF_; }
YY_BREAK
case 25:
YY_RULE_SETUP
#line 73 "lex.l"
{ return _FOR_; }
{ return _THEM_; }
YY_BREAK
case 26:
YY_RULE_SETUP
#line 74 "lex.l"
{ return _ALL_; }
{ return _FOR_; }
YY_BREAK
case 27:
YY_RULE_SETUP
#line 75 "lex.l"
{ return _ANY_; }
{ return _ALL_; }
YY_BREAK
case 28:
YY_RULE_SETUP
#line 76 "lex.l"
{ return _ENTRYPOINT_; }
{ return _ANY_; }
YY_BREAK
case 29:
YY_RULE_SETUP
#line 77 "lex.l"
{ return _SIZE_; }
{ return _ENTRYPOINT_; }
YY_BREAK
case 30:
YY_RULE_SETUP
#line 78 "lex.l"
{ return _RVA_; }
{ return _SIZE_; }
YY_BREAK
case 31:
YY_RULE_SETUP
#line 79 "lex.l"
{ return _OFFSET_; }
{ return _RVA_; }
YY_BREAK
case 32:
YY_RULE_SETUP
#line 80 "lex.l"
{ return _FILE_; }
{ return _OFFSET_; }
YY_BREAK
case 33:
YY_RULE_SETUP
#line 81 "lex.l"
{ return _IS_; }
{ return _FILE_; }
YY_BREAK
case 34:
YY_RULE_SETUP
#line 82 "lex.l"
{ return _SECTION_; }
{ return _IS_; }
YY_BREAK
case 35:
YY_RULE_SETUP
#line 83 "lex.l"
{ return _UINT8_; }
{ return _SECTION_; }
YY_BREAK
case 36:
YY_RULE_SETUP
#line 84 "lex.l"
{ return _UINT16_; }
{ return _UINT8_; }
YY_BREAK
case 37:
YY_RULE_SETUP
#line 85 "lex.l"
{ return _UINT32_; }
{ return _UINT16_; }
YY_BREAK
case 38:
YY_RULE_SETUP
#line 86 "lex.l"
{ return _INT8_; }
{ return _UINT32_; }
YY_BREAK
case 39:
YY_RULE_SETUP
#line 87 "lex.l"
{ return _INT16_; }
{ return _INT8_; }
YY_BREAK
case 40:
YY_RULE_SETUP
#line 88 "lex.l"
{ return _INT32_; }
{ return _INT16_; }
YY_BREAK
case 41:
/* rule 41 can match eol */
YY_RULE_SETUP
#line 92 "lex.l"
{ /* skip comments */ }
#line 89 "lex.l"
{ return _INT32_; }
YY_BREAK
case 42:
/* rule 42 can match eol */
YY_RULE_SETUP
#line 94 "lex.l"
{ /* skip single-line comments */ }
#line 93 "lex.l"
{ /* skip comments */ }
YY_BREAK
case 43:
YY_RULE_SETUP
#line 96 "lex.l"
#line 95 "lex.l"
{ /* skip single-line comments */ }
YY_BREAK
case 44:
YY_RULE_SETUP
#line 97 "lex.l"
{
yyextra->lex_buf_ptr = yyextra->lex_buf;
yyextra->lex_buf_len = 0;
BEGIN(include);
}
YY_BREAK
case 44:
/* rule 44 can match eol */
case 45:
/* rule 45 can match eol */
YY_RULE_SETUP
#line 102 "lex.l"
#line 103 "lex.l"
{
YYTEXT_TO_BUFFER;
}
YY_BREAK
case 45:
case 46:
YY_RULE_SETUP
#line 106 "lex.l"
#line 107 "lex.l"
{
char buffer[1024];
char *current_file_name;
@@ -1288,7 +1293,7 @@ case YY_STATE_EOF(INITIAL):
case YY_STATE_EOF(str):
case YY_STATE_EOF(regexp):
case YY_STATE_EOF(include):
#line 182 "lex.l"
#line 183 "lex.l"
{
YARA_CONTEXT* context = yyget_extra(yyscanner);
@@ -1302,43 +1307,43 @@ case YY_STATE_EOF(include):
}
}
YY_BREAK
case 46:
case 47:
YY_RULE_SETUP
#line 196 "lex.l"
#line 197 "lex.l"
{
yylval->c_string = (char*) yr_strdup(yytext);
return _STRING_IDENTIFIER_WITH_WILDCARD_;
}
YY_BREAK
case 47:
case 48:
YY_RULE_SETUP
#line 201 "lex.l"
#line 202 "lex.l"
{
yylval->c_string = (char*) yr_strdup(yytext);
return _STRING_IDENTIFIER_;
}
YY_BREAK
case 48:
case 49:
YY_RULE_SETUP
#line 207 "lex.l"
#line 208 "lex.l"
{
yylval->c_string = (char*) yr_strdup(yytext);
yylval->c_string[0] = '$'; /* replace # by $*/
return _STRING_COUNT_;
}
YY_BREAK
case 49:
case 50:
YY_RULE_SETUP
#line 213 "lex.l"
#line 214 "lex.l"
{
yylval->c_string = (char*) yr_strdup(yytext);
yylval->c_string[0] = '$'; /* replace @ by $*/
return _STRING_OFFSET_;
}
YY_BREAK
case 50:
case 51:
YY_RULE_SETUP
#line 219 "lex.l"
#line 220 "lex.l"
{
if (strlen(yytext) > 128)
{
@@ -1349,9 +1354,9 @@ YY_RULE_SETUP
return _IDENTIFIER_;
}
YY_BREAK
case 51:
case 52:
YY_RULE_SETUP
#line 229 "lex.l"
#line 230 "lex.l"
{
yylval->integer = (unsigned int) atoi(yytext);
@@ -1367,17 +1372,17 @@ YY_RULE_SETUP
return _NUMBER_;
}
YY_BREAK
case 52:
case 53:
YY_RULE_SETUP
#line 244 "lex.l"
#line 245 "lex.l"
{
yylval->integer = xtoi(yytext + 2);
return _NUMBER_;
}
YY_BREAK
case 53:
case 54:
YY_RULE_SETUP
#line 249 "lex.l"
#line 250 "lex.l"
{ /* saw closing quote - all done */
SIZED_STRING* s;
@@ -1402,24 +1407,24 @@ YY_RULE_SETUP
return _TEXTSTRING_;
}
YY_BREAK
case 54:
YY_RULE_SETUP
#line 273 "lex.l"
{ *yyextra->lex_buf_ptr++ = '\t'; yyextra->lex_buf_len++; }
YY_BREAK
case 55:
YY_RULE_SETUP
#line 274 "lex.l"
{ *yyextra->lex_buf_ptr++ = '\"'; yyextra->lex_buf_len++; }
{ *yyextra->lex_buf_ptr++ = '\t'; yyextra->lex_buf_len++; }
YY_BREAK
case 56:
YY_RULE_SETUP
#line 275 "lex.l"
{ *yyextra->lex_buf_ptr++ = '\\'; yyextra->lex_buf_len++; }
{ *yyextra->lex_buf_ptr++ = '\"'; yyextra->lex_buf_len++; }
YY_BREAK
case 57:
YY_RULE_SETUP
#line 277 "lex.l"
#line 276 "lex.l"
{ *yyextra->lex_buf_ptr++ = '\\'; yyextra->lex_buf_len++; }
YY_BREAK
case 58:
YY_RULE_SETUP
#line 278 "lex.l"
{
int result;
@@ -1429,33 +1434,33 @@ YY_RULE_SETUP
yyextra->lex_buf_len++;
}
YY_BREAK
case 58:
case 59:
YY_RULE_SETUP
#line 286 "lex.l"
#line 287 "lex.l"
{
YYTEXT_TO_BUFFER;
}
YY_BREAK
case 59:
/* rule 59 can match eol */
case 60:
/* rule 60 can match eol */
YY_RULE_SETUP
#line 290 "lex.l"
#line 291 "lex.l"
{
yyerror(yyscanner, "unterminated string");
yyterminate();
}
YY_BREAK
case 60:
/* rule 60 can match eol */
case 61:
/* rule 61 can match eol */
YY_RULE_SETUP
#line 295 "lex.l"
#line 296 "lex.l"
{
yyerror(yyscanner, "illegal escape sequence");
}
YY_BREAK
case 61:
case 62:
YY_RULE_SETUP
#line 300 "lex.l"
#line 301 "lex.l"
{
SIZED_STRING* s;
@@ -1478,60 +1483,60 @@ YY_RULE_SETUP
return _REGEXP_;
}
YY_BREAK
case 62:
case 63:
YY_RULE_SETUP
#line 322 "lex.l"
#line 323 "lex.l"
{
*yyextra->lex_buf_ptr++ = '/';
yyextra->lex_buf_len++ ;
}
YY_BREAK
case 63:
case 64:
YY_RULE_SETUP
#line 327 "lex.l"
#line 328 "lex.l"
{
*yyextra->lex_buf_ptr++ = yytext[0];
*yyextra->lex_buf_ptr++ = yytext[1];
yyextra->lex_buf_len += 2;
}
YY_BREAK
case 64:
case 65:
YY_RULE_SETUP
#line 333 "lex.l"
#line 334 "lex.l"
{
YYTEXT_TO_BUFFER;
}
YY_BREAK
case 65:
/* rule 65 can match eol */
case 66:
/* rule 66 can match eol */
YY_RULE_SETUP
#line 337 "lex.l"
#line 338 "lex.l"
{
yyerror(yyscanner, "unterminated regular expression");
yyterminate();
}
YY_BREAK
case 66:
case 67:
YY_RULE_SETUP
#line 342 "lex.l"
#line 343 "lex.l"
{
yyextra->lex_buf_ptr = yyextra->lex_buf;
yyextra->lex_buf_len = 0;
BEGIN(str);
}
YY_BREAK
case 67:
case 68:
YY_RULE_SETUP
#line 348 "lex.l"
#line 349 "lex.l"
{
yyextra->lex_buf_ptr = yyextra->lex_buf;
yyextra->lex_buf_len = 0;
BEGIN(regexp);
}
YY_BREAK
case 68:
case 69:
YY_RULE_SETUP
#line 354 "lex.l"
#line 355 "lex.l"
{
int len = strlen(yytext);
@@ -1546,25 +1551,25 @@ YY_RULE_SETUP
return _HEXSTRING_;
}
YY_BREAK
case 69:
/* rule 69 can match eol */
case 70:
/* rule 70 can match eol */
YY_RULE_SETUP
#line 368 "lex.l"
#line 369 "lex.l"
/* skip whitespace */
YY_BREAK
case 70:
case 71:
YY_RULE_SETUP
#line 370 "lex.l"
#line 371 "lex.l"
{
return yytext[0];
}
YY_BREAK
case 71:
case 72:
YY_RULE_SETUP
#line 373 "lex.l"
#line 374 "lex.l"
ECHO;
YY_BREAK
#line 1568 "lex.c"
#line 1573 "lex.c"
case YY_END_OF_BUFFER:
{
@@ -1848,7 +1853,7 @@ static int yy_get_next_buffer (yyscan_t yyscanner)
while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
{
yy_current_state = (int) yy_def[yy_current_state];
if ( yy_current_state >= 205 )
if ( yy_current_state >= 209 )
yy_c = yy_meta[(unsigned int) yy_c];
}
yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
@@ -1877,11 +1882,11 @@ static int yy_get_next_buffer (yyscan_t yyscanner)
while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
{
yy_current_state = (int) yy_def[yy_current_state];
if ( yy_current_state >= 205 )
if ( yy_current_state >= 209 )
yy_c = yy_meta[(unsigned int) yy_c];
}
yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
yy_is_jam = (yy_current_state == 204);
yy_is_jam = (yy_current_state == 208);
return yy_is_jam ? 0 : yy_current_state;
}
@@ -2692,7 +2697,7 @@ void yyfree (void * ptr , yyscan_t yyscanner)
#define YYTABLES_NAME "yytables"
#line 373 "lex.l"
#line 374 "lex.l"
libyara/lex.l
+1
View File
@@ -55,6 +55,7 @@ hexdigit [a-fA-F0-9]
"private" { return _PRIVATE_; }
"global" { return _GLOBAL_; }
"rule" { return _RULE_; }
"meta" { return _META_; }
"strings" { return _STRINGS_; }
"ascii" { return _ASCII_; }
"wide" { return _WIDE_; }
libyara/libtool
+17 -17
View File
@@ -1,7 +1,7 @@
#! /bin/sh
# libtoolT - Provide generalized library-building support services.
# Generated automatically by (GNU libyara 1.1.1)
# Generated automatically by (GNU libyara 1.3)
# NOTE: Changes made to this file will be lost: look at ltmain.sh.
#
# Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001
@@ -44,7 +44,7 @@ available_tags=" CXX"
# ### BEGIN LIBTOOL CONFIG
# Libtool was configured on host hydra.local:
# Libtool was configured on host andromeda.local:
# Shell to use when invoking shell scripts.
SHELL="/bin/sh"
@@ -66,13 +66,13 @@ fast_install=needless
# The host system.
host_alias=
host=i386-apple-darwin10.0.0
host_os=darwin10.0.0
host=i386-apple-darwin9.8.0
host_os=darwin9.8.0
# The build system.
build_alias=
build=i386-apple-darwin10.0.0
build_os=darwin10.0.0
build=i386-apple-darwin9.8.0
build_os=darwin9.8.0
# An echo program that does not interpret backslashes.
echo="/bin/echo"
@@ -97,13 +97,13 @@ with_gcc=yes
EGREP="/usr/bin/grep -E"
# The linker used to build libraries.
LD="/usr/libexec/gcc/i686-apple-darwin10/4.2.1/ld"
LD="/usr/libexec/gcc/i686-apple-darwin9/4.0.1/ld"
# Whether we need hard or soft links.
LN_S="ln -s"
# A BSD-compatible nm program.
NM="/usr/bin/nm"
NM="/usr/bin/nm -p"
# A symbol stripping program
STRIP="strip"
@@ -322,7 +322,7 @@ variables_saved_for_relink="PATH DYLD_LIBRARY_PATH GCC_EXEC_PREFIX COMPILER_PAT
link_all_deplibs=yes
# Compile-time system search path for libraries
sys_lib_search_path_spec=" /lib/i686-apple-darwin10/4.2.1/x86_64/ /lib/x86_64/ /usr/lib/i686-apple-darwin10/4.2.1/x86_64/ /usr/lib/x86_64/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/x86_64/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/x86_64/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/../../../../i686-apple-darwin10/lib/i686-apple-darwin10/4.2.1/x86_64/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/../../../../i686-apple-darwin10/lib/x86_64/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/../../../i686-apple-darwin10/4.2.1/x86_64/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/../../../x86_64/ /lib/i686-apple-darwin10/4.2.1/ /lib/ /usr/lib/i686-apple-darwin10/4.2.1/ /usr/lib/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/../../../../i686-apple-darwin10/lib/i686-apple-darwin10/4.2.1/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/../../../../i686-apple-darwin10/lib/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/../../../i686-apple-darwin10/4.2.1/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/../../../ /lib /usr/lib /usr/local/lib"
sys_lib_search_path_spec=" /lib/i686-apple-darwin9/4.0.1/ /lib/ /usr/lib/i686-apple-darwin9/4.0.1/ /usr/lib/ /usr/lib/gcc/i686-apple-darwin9/4.0.1/ /usr/lib/gcc/i686-apple-darwin9/4.0.1/ /usr/lib/gcc/i686-apple-darwin9/4.0.1/../../../../i686-apple-darwin9/lib/i686-apple-darwin9/4.0.1/ /usr/lib/gcc/i686-apple-darwin9/4.0.1/../../../../i686-apple-darwin9/lib/ /usr/lib/gcc/i686-apple-darwin9/4.0.1/../../../i686-apple-darwin9/4.0.1/ /usr/lib/gcc/i686-apple-darwin9/4.0.1/../../../ /lib /usr/lib /usr/local/lib"
# Run-time system search path for libraries
sys_lib_dlsearch_path_spec="/usr/local/lib /lib /usr/lib"
@@ -7212,7 +7212,7 @@ disable_libs=static
# End:
# ### BEGIN LIBTOOL TAG CONFIG: CXX
# Libtool was configured on host hydra.local:
# Libtool was configured on host andromeda.local:
# Shell to use when invoking shell scripts.
SHELL="/bin/sh"
@@ -7234,13 +7234,13 @@ fast_install=needless
# The host system.
host_alias=
host=i386-apple-darwin10.0.0
host_os=darwin10.0.0
host=i386-apple-darwin9.8.0
host_os=darwin9.8.0
# The build system.
build_alias=
build=i386-apple-darwin10.0.0
build_os=darwin10.0.0
build=i386-apple-darwin9.8.0
build_os=darwin9.8.0
# An echo program that does not interpret backslashes.
echo="/bin/echo"
@@ -7265,13 +7265,13 @@ with_gcc=yes
EGREP="/usr/bin/grep -E"
# The linker used to build libraries.
LD="/usr/libexec/gcc/i686-apple-darwin10/4.2.1/ld"
LD="/usr/libexec/gcc/i686-apple-darwin9/4.0.1/ld"
# Whether we need hard or soft links.
LN_S="ln -s"
# A BSD-compatible nm program.
NM="/usr/bin/nm"
NM="/usr/bin/nm -p"
# A symbol stripping program
STRIP="strip"
@@ -7490,7 +7490,7 @@ variables_saved_for_relink="PATH DYLD_LIBRARY_PATH GCC_EXEC_PREFIX COMPILER_PAT
link_all_deplibs=yes
# Compile-time system search path for libraries
sys_lib_search_path_spec=" /lib/i686-apple-darwin10/4.2.1/x86_64/ /lib/x86_64/ /usr/lib/i686-apple-darwin10/4.2.1/x86_64/ /usr/lib/x86_64/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/x86_64/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/x86_64/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/../../../../i686-apple-darwin10/lib/i686-apple-darwin10/4.2.1/x86_64/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/../../../../i686-apple-darwin10/lib/x86_64/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/../../../i686-apple-darwin10/4.2.1/x86_64/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/../../../x86_64/ /lib/i686-apple-darwin10/4.2.1/ /lib/ /usr/lib/i686-apple-darwin10/4.2.1/ /usr/lib/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/../../../../i686-apple-darwin10/lib/i686-apple-darwin10/4.2.1/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/../../../../i686-apple-darwin10/lib/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/../../../i686-apple-darwin10/4.2.1/ /usr/lib/gcc/i686-apple-darwin10/4.2.1/../../../ /lib /usr/lib /usr/local/lib"
sys_lib_search_path_spec=" /lib/i686-apple-darwin9/4.0.1/ /lib/ /usr/lib/i686-apple-darwin9/4.0.1/ /usr/lib/ /usr/lib/gcc/i686-apple-darwin9/4.0.1/ /usr/lib/gcc/i686-apple-darwin9/4.0.1/ /usr/lib/gcc/i686-apple-darwin9/4.0.1/../../../../i686-apple-darwin9/lib/i686-apple-darwin9/4.0.1/ /usr/lib/gcc/i686-apple-darwin9/4.0.1/../../../../i686-apple-darwin9/lib/ /usr/lib/gcc/i686-apple-darwin9/4.0.1/../../../i686-apple-darwin9/4.0.1/ /usr/lib/gcc/i686-apple-darwin9/4.0.1/../../../ /lib /usr/lib /usr/local/lib"
# Run-time system search path for libraries
sys_lib_dlsearch_path_spec="/usr/local/lib /lib /usr/lib"
libyara/libyara.c
+23 -1
View File
@@ -65,6 +65,8 @@ void yr_destroy_context(YARA_CONTEXT* context)
RULE* next_rule;
STRING* string;
STRING* next_string;
META* meta;
META* next_meta;
MATCH* match;
MATCH* next_match;
TAG* tag;
@@ -121,6 +123,23 @@ void yr_destroy_context(YARA_CONTEXT* context)
tag = next_tag;
}
meta = rule->meta_list_head;
while (meta != NULL)
{
next_meta = meta->next;
if (meta->type == META_TYPE_STRING)
{
yr_free(meta->string);
}
yr_free(meta->identifier);
yr_free(meta);
meta = next_meta;
}
free_term(rule->condition);
yr_free(rule->identifier);
@@ -380,7 +399,10 @@ char* yr_get_error_message(YARA_CONTEXT* context, char* buffer, int buffer_size)
break;
case ERROR_DUPLICATE_TAG_IDENTIFIER:
snprintf(buffer, buffer_size, "duplicate tag identifier \"%s\"", context->last_error_extra_info);
break;
break;
case ERROR_DUPLICATE_META_IDENTIFIER:
snprintf(buffer, buffer_size, "duplicate metadata identifier \"%s\"", context->last_error_extra_info);
break;
case ERROR_INVALID_CHAR_IN_HEX_STRING:
snprintf(buffer, buffer_size, "invalid char in hex string \"%s\"", context->last_error_extra_info);
break;
libyara/libyara.tmproj
+62 -78
View File
@@ -3,7 +3,7 @@
<plist version="1.0">
<dict>
<key>currentDocument</key>
<string>ast.c</string>
<string>../yara.c</string>
<key>documents</key>
<array>
<dict>
@@ -13,63 +13,63 @@
<key>filename</key>
<string>scan.c</string>
<key>lastUsed</key>
<date>2009-10-23T14:08:40Z</date>
<date>2009-10-24T20:43:08Z</date>
</dict>
<dict>
<key>filename</key>
<string>pefile.c</string>
<key>lastUsed</key>
<date>2009-06-23T09:46:58Z</date>
<date>2009-10-24T20:35:58Z</date>
</dict>
<dict>
<key>filename</key>
<string>filemap.c</string>
<key>lastUsed</key>
<date>2009-07-22T16:18:23Z</date>
<date>2009-10-24T20:36:02Z</date>
</dict>
<dict>
<key>filename</key>
<string>eval.c</string>
<key>lastUsed</key>
<date>2009-10-23T15:50:54Z</date>
<date>2009-10-24T19:10:43Z</date>
</dict>
<dict>
<key>filename</key>
<string>ast.c</string>
<key>lastUsed</key>
<date>2009-10-23T15:50:54Z</date>
<key>selected</key>
<true/>
<date>2009-10-24T20:52:56Z</date>
</dict>
<dict>
<key>filename</key>
<string>lex.l</string>
<key>lastUsed</key>
<date>2009-10-23T14:30:38Z</date>
<date>2009-10-24T22:47:38Z</date>
</dict>
<dict>
<key>filename</key>
<string>grammar.y</string>
<key>lastUsed</key>
<date>2009-10-23T14:27:20Z</date>
<date>2009-10-24T22:50:49Z</date>
</dict>
<dict>
<key>filename</key>
<string>../yara.c</string>
<key>lastUsed</key>
<date>2009-10-22T14:22:47Z</date>
<date>2009-10-24T22:50:49Z</date>
<key>selected</key>
<true/>
</dict>
<dict>
<key>filename</key>
<string>mem.c</string>
<key>lastUsed</key>
<date>2009-10-22T13:00:13Z</date>
<date>2009-10-24T20:52:59Z</date>
</dict>
<dict>
<key>filename</key>
<string>libyara.c</string>
<key>lastUsed</key>
<date>2009-10-23T14:19:39Z</date>
<date>2009-10-24T22:50:36Z</date>
</dict>
</array>
<key>expanded</key>
@@ -84,19 +84,19 @@
<key>filename</key>
<string>yara.h</string>
<key>lastUsed</key>
<date>2009-10-23T14:08:35Z</date>
<date>2009-10-24T22:49:55Z</date>
</dict>
<dict>
<key>filename</key>
<string>pefile.h</string>
<key>lastUsed</key>
<date>2009-10-22T14:25:01Z</date>
<date>2009-10-24T19:55:29Z</date>
</dict>
<dict>
<key>filename</key>
<string>pe.h</string>
<key>lastUsed</key>
<date>2009-10-22T12:07:11Z</date>
<date>2009-10-24T21:05:01Z</date>
</dict>
<dict>
<key>filename</key>
@@ -108,31 +108,31 @@
<key>filename</key>
<string>eval.h</string>
<key>lastUsed</key>
<date>2009-10-23T14:20:32Z</date>
<date>2009-10-24T20:32:38Z</date>
</dict>
<dict>
<key>filename</key>
<string>ast.h</string>
<key>lastUsed</key>
<date>2009-10-23T14:27:23Z</date>
<date>2009-10-24T21:01:57Z</date>
</dict>
<dict>
<key>filename</key>
<string>sizedstr.h</string>
<key>lastUsed</key>
<date>2009-10-22T14:24:38Z</date>
<date>2009-10-24T21:02:00Z</date>
</dict>
<dict>
<key>filename</key>
<string>mem.h</string>
<key>lastUsed</key>
<date>2009-10-22T14:24:36Z</date>
<date>2009-10-24T21:04:57Z</date>
</dict>
<dict>
<key>filename</key>
<string>scan.h</string>
<key>lastUsed</key>
<date>2009-10-22T14:24:55Z</date>
<date>2009-10-24T20:32:40Z</date>
</dict>
<dict>
<key>filename</key>
@@ -148,7 +148,7 @@
</dict>
</array>
<key>fileHierarchyDrawerWidth</key>
<integer>141</integer>
<integer>131</integer>
<key>metaData</key>
<dict>
<key>../yara.c</key>
@@ -156,58 +156,42 @@
<key>caret</key>
<dict>
<key>column</key>
<integer>10</integer>
<integer>80</integer>
<key>line</key>
<integer>202</integer>
<integer>308</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>472</integer>
<integer>293</integer>
</dict>
<key>ast.c</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>20</integer>
<integer>34</integer>
<key>line</key>
<integer>80</integer>
<integer>154</integer>
</dict>
<key>columnSelection</key>
<false/>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>70</integer>
<key>selectFrom</key>
<dict>
<key>column</key>
<integer>4</integer>
<key>line</key>
<integer>80</integer>
</dict>
<key>selectTo</key>
<dict>
<key>column</key>
<integer>20</integer>
<key>line</key>
<integer>80</integer>
</dict>
<integer>136</integer>
</dict>
<key>ast.h</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>55</integer>
<integer>124</integer>
<key>line</key>
<integer>74</integer>
<integer>132</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>40</integer>
<integer>16</integer>
</dict>
<key>eval.c</key>
<dict>
@@ -270,14 +254,14 @@
<key>caret</key>
<dict>
<key>column</key>
<integer>54</integer>
<integer>25</integer>
<key>line</key>
<integer>558</integer>
<integer>748</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>334</integer>
<integer>730</integer>
</dict>
<key>lex.h</key>
<dict>
@@ -298,44 +282,28 @@
<key>caret</key>
<dict>
<key>column</key>
<integer>0</integer>
<integer>40</integer>
<key>line</key>
<integer>419</integer>
<integer>57</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>76</integer>
<integer>140</integer>
</dict>
<key>libyara.c</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>0</integer>
<integer>52</integer>
<key>line</key>
<integer>151</integer>
<integer>403</integer>
</dict>
<key>columnSelection</key>
<false/>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>140</integer>
<key>selectFrom</key>
<dict>
<key>column</key>
<integer>2</integer>
<key>line</key>
<integer>151</integer>
</dict>
<key>selectTo</key>
<dict>
<key>column</key>
<integer>0</integer>
<key>line</key>
<integer>151</integer>
</dict>
<integer>116</integer>
</dict>
<key>mem.c</key>
<dict>
@@ -456,28 +424,44 @@
<key>caret</key>
<dict>
<key>column</key>
<integer>15</integer>
<integer>25</integer>
<key>line</key>
<integer>30</integer>
<integer>25</integer>
</dict>
<key>columnSelection</key>
<false/>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>0</integer>
<key>selectFrom</key>
<dict>
<key>column</key>
<integer>16</integer>
<key>line</key>
<integer>25</integer>
</dict>
<key>selectTo</key>
<dict>
<key>column</key>
<integer>25</integer>
<key>line</key>
<integer>25</integer>
</dict>
</dict>
<key>yara.h</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>0</integer>
<integer>24</integer>
<key>line</key>
<integer>228</integer>
<integer>169</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>218</integer>
<integer>153</integer>
</dict>
</dict>
<key>openDocuments</key>
@@ -506,6 +490,6 @@
<key>showFileHierarchyDrawer</key>
<true/>
<key>windowFrame</key>
<string>{{158, 51}, {1112, 727}}</string>
<string>{{159, 51}, {1112, 727}}</string>
</dict>
</plist>
libyara/yara.h
+23
View File
@@ -92,6 +92,11 @@ GNU General Public License for more details.
#define ERROR_COULD_NOT_MAP_FILE 24
#define ERROR_ZERO_LENGTH_FILE 25
#define ERROR_INVALID_ARGUMENT 26
#define ERROR_DUPLICATE_META_IDENTIFIER 27
#define META_TYPE_INTEGER 1
#define META_TYPE_STRING 2
#define META_TYPE_BOOLEAN 3
typedef struct _MATCH
@@ -154,6 +159,22 @@ typedef struct _NAMESPACE
} NAMESPACE;
typedef struct _META
{
int type;
char* identifier;
union {
char* string;
int integer;
int boolean;
};
struct _META* next;
} META;
typedef struct _RULE
{
char* identifier;
@@ -161,6 +182,7 @@ typedef struct _RULE
NAMESPACE* namespace;
STRING* string_list_head;
TAG* tag_list_head;
META* meta_list_head;
TERM* condition;
struct _RULE* next;
@@ -231,6 +253,7 @@ typedef struct _YARA_CONTEXT
RULE* lookup_rule(RULE_LIST* rules, char* identifier, NAMESPACE* namespace);
STRING* lookup_string(STRING* string_list_head, char* identifier);
TAG* lookup_tag(TAG* tag_list_head, char* identifier);
META* lookup_meta(META* meta_list_head, char* identifier);
void yr_init();
yara-python/setup.py
+1 -1
View File
@@ -2,7 +2,7 @@ from distutils.core import setup, Extension
setup(name = "yara-python",
version = "1.2.1",
version = "1.3",
author = "Victor M. Alvarez",
author_email = "[email protected]",
url = 'http://yara.googlecode.com',
yara-python/setupwin.py
+1 -1
View File
@@ -2,7 +2,7 @@ from distutils.core import setup, Extension
setup(name = "yara-python",
version = "1.2.1",
version = "1.3",
author = "Victor M. Alvarez",
author_email = "[email protected]",
ext_modules = [ Extension(
yara-python/yara-python.c
+39 -5
View File
@@ -87,6 +87,7 @@ typedef struct {
PyObject* rule;
PyObject* namespace;
PyObject* tags;
PyObject* meta;
PyObject* strings;
} Match;
@@ -102,6 +103,7 @@ static PyMemberDef Match_members[] = {
{"rule", T_OBJECT_EX, offsetof(Match, rule), READONLY, "Name of the matching rule"},
{"namespace", T_OBJECT_EX, offsetof(Match, namespace), READONLY, "Namespace of the matching rule"},
{"tags", T_OBJECT_EX, offsetof(Match, tags), READONLY, "List of tags associated to the rule"},
{"meta", T_OBJECT_EX, offsetof(Match, meta), READONLY, "Dictionary with metadata associated to the rule"},
{"strings", T_OBJECT_EX, offsetof(Match, strings), READONLY, "Dictionary with offsets and strings that matched the file"},
{NULL} /* Sentinel */
};
@@ -154,7 +156,7 @@ static PyTypeObject Match_Type = {
};
static PyObject * Match_NEW(const char* rule, const char* namespace, PyObject* tags, PyObject* strings)
static PyObject * Match_NEW(const char* rule, const char* namespace, PyObject* tags, PyObject* meta, PyObject* strings)
{
Match* object;
@@ -165,6 +167,7 @@ static PyObject * Match_NEW(const char* rule, const char* namespace, PyObject* t
object->rule = PyString_FromString(rule);
object->namespace = PyString_FromString(namespace);
object->tags = tags;
object->meta = meta;
object->strings = strings;
}
@@ -177,7 +180,8 @@ static void Match_dealloc(PyObject *self)
Py_DECREF(object->rule);
Py_DECREF(object->namespace);
Py_DECREF(object->tags);
Py_DECREF(object->tags);
Py_DECREF(object->meta);
Py_DECREF(object->strings);
PyObject_Del(self);
@@ -401,8 +405,10 @@ int callback(RULE* rule, unsigned char* buffer, unsigned int buffer_size, void*
TAG* tag;
STRING* string;
MATCH* m;
META* meta;
PyObject* taglist = NULL;
PyObject* stringlist = NULL;
PyObject* metalist = NULL;
PyObject* match;
PyObject* list = (PyObject*) data;
@@ -411,8 +417,9 @@ int callback(RULE* rule, unsigned char* buffer, unsigned int buffer_size, void*
taglist = PyList_New(0);
stringlist = PyDict_New();
metalist = PyDict_New();
if (taglist == NULL || stringlist == NULL)
if (taglist == NULL || stringlist == NULL || metalist == NULL)
return 1; // error!
tag = rule->tag_list_head;
@@ -421,7 +428,33 @@ int callback(RULE* rule, unsigned char* buffer, unsigned int buffer_size, void*
{
PyList_Append(taglist, PyString_FromString(tag->identifier));
tag = tag->next;
}
}
meta = rule->meta_list_head;
while(meta != NULL)
{
if (meta->type == META_TYPE_INTEGER)
{
PyDict_SetItem( metalist,
PyString_FromString(meta->identifier),
Py_BuildValue("I", meta->integer));
}
else if (meta->type == META_TYPE_BOOLEAN)
{
PyDict_SetItem( metalist,
PyString_FromString(meta->identifier),
PyBool_FromLong(meta->boolean));
}
else
{
PyDict_SetItem( metalist,
PyString_FromString(meta->identifier),
PyString_FromString(meta->string));
}
meta = meta->next;
}
string = rule->string_list_head;
@@ -443,7 +476,7 @@ int callback(RULE* rule, unsigned char* buffer, unsigned int buffer_size, void*
string = string->next;
}
match = Match_NEW(rule->identifier, rule->namespace->name, taglist, stringlist);
match = Match_NEW(rule->identifier, rule->namespace->name, taglist, metalist, stringlist);
if (match != NULL)
{
@@ -453,6 +486,7 @@ int callback(RULE* rule, unsigned char* buffer, unsigned int buffer_size, void*
{
Py_DECREF(taglist);
Py_DECREF(stringlist);
Py_DECREF(metalist);
return 1;
}
yara.c
+56 -27
View File
@@ -37,6 +37,7 @@ int show_tags = FALSE;
int show_specified_tags = FALSE;
int show_specified_rules = FALSE;
int show_strings = FALSE;
int show_meta = FALSE;
int negate = FALSE;
TAG* specified_tags_list = NULL;
@@ -61,6 +62,7 @@ void show_help()
printf(" -i <identifier> print rules named <identifier> and ignore the rest. Can be used more than once.\n");
printf(" -n print only not satisfied rules (negate).\n");
printf(" -g print tags.\n");
printf(" -m print metadata.\n");
printf(" -s print matching strings.\n");
printf(" -r recursively search directories.\n");
printf(" -v show version information.\n");
@@ -218,6 +220,7 @@ int callback(RULE* rule, unsigned char* buffer, unsigned int buffer_size, void*
TAG* tag;
IDENTIFIER* identifier;
STRING* string;
META* meta;
MATCH* match;
int rule_match;
@@ -264,40 +267,62 @@ int callback(RULE* rule, unsigned char* buffer, unsigned int buffer_size, void*
if (show)
{
printf("%s ", rule->identifier);
if (show_tags)
{
printf("%s", rule->identifier);
{
tag = rule->tag_list_head;
if (tag != NULL)
{
printf(" [");
while(tag != NULL)
printf("[");
while(tag != NULL)
{
if (tag->next == NULL)
{
if (tag->next == NULL)
{
printf("%s", tag->identifier);
}
else
{
printf("%s,", tag->identifier);
}
tag = tag->next;
printf("%s", tag->identifier);
}
printf("]");
}
printf(" %s\n", (char*) data);
else
{
printf("%s,", tag->identifier);
}
tag = tag->next;
}
printf("] ");
}
else
if (show_meta)
{
printf("%s %s\n", rule->identifier, (char*) data);
}
meta = rule->meta_list_head;
printf("[");
while(meta != NULL)
{
if (meta->type == META_TYPE_INTEGER)
{
printf("%s=%d", meta->identifier, meta->integer);
}
else if (meta->type == META_TYPE_BOOLEAN)
{
printf("%s=%s", meta->identifier, (meta->boolean)?("true"):("false"));
}
else
{
printf("%s=\"%s\"", meta->identifier, meta->string);
}
if (meta->next != NULL)
printf(",");
meta = meta->next;
}
printf("] ");
}
printf("%s\n", (char*) data);
/* show matched strings */
@@ -349,7 +374,7 @@ int process_cmd_line(int argc, char const* argv[])
IDENTIFIER* identifier;
opterr = 0;
while ((c = getopt (argc, (char**) argv, "rnsvgt:i:")) != -1)
while ((c = getopt (argc, (char**) argv, "rnsvgmt:i:")) != -1)
{
switch (c)
{
@@ -365,6 +390,10 @@ int process_cmd_line(int argc, char const* argv[])
show_tags = TRUE;
break;
case 'm':
show_meta = TRUE;
break;
case 's':
show_strings = TRUE;
break;