VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-12 02:10:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Note that hash matching requires lowercase hash (#1106)

Browse Source 
* Note that hash matching requires lowercase hash

https://github.com/VirusTotal/yara/issues/1004

* Clarify why hash cond needs to be lowercase
This commit is contained in:
Ԝеѕ
2019-09-23 13:02:44 +02:00
committed by Victor M. Alvarez
parent aad709ed37
commit 4df40fca36
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/modules/hash.rst
+6
View File
@@ -18,6 +18,12 @@ of your file and create signatures based on those hashes.
Good news for Windows users: this module is already included in the official
Windows binaries.
.. warning::
The returned hash string is always in lowercase. This means that rule condition matching on hashes
``hash.md5(0, filesize) == "feba6c919e3797e7778e8f2e85fa033d"``
requires the hash string to be given in lowercase, otherwise the match condition
will not work. (see https://github.com/VirusTotal/yara/issues/1004)
.. c:function:: md5(offset, size)
Returns the MD5 hash for *size* bytes starting at *offset*. When scanning a