mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-12 02:10:00 +00:00
Fixes for xor modifier. (#1113)
* Fixes for xor modifier. This commit makes the xor modifier no longer include "plaintext" versions of the strings. In particular if you have: $a = "This program cannot" xor Then it will no longer match on the plaintext version of the string. It will only match on the xor versions. If you want it to match on plaintext or xor then you can use: $a = "This program cannot" xor ascii The same is true for wide. * Make 'xor nocase' a compiler error. * Add newline between ascii and wide strings.
This commit is contained in:
committed by
Victor M. Alvarez
parent
96017d8405
commit
627ef691d7
Binary file not shown.
Binary file not shown.
Reference in New Issue
Block a user