VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-11 22:49:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Lots of changes for version 1.1

Browse Source
This commit is contained in:
Victor M. Alvarez
2008-12-23 11:54:43 +00:00
parent ab87d5f0ca
commit 8626fc113a
31 changed files with 1619 additions and 1153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ChangeLog
+8 -1
View File
@@ -1,3 +1,10 @@
version 1.0 (24/09/2008)
* first release
* first release
version 1.1
* added support for strings containing null (\x00) chars
* added syntactic construct "x of them"
* regular expressions syntax changed
* now regular expressions can begin with any character
Makefile
+14 -14
View File
@@ -86,11 +86,11 @@ DIST_ARCHIVES = $(distdir).tar.gz
GZIP_ENV = --best
distuninstallcheck_listfiles = find . -type f -print
distcleancheck_listfiles = find . -type f -print
ACLOCAL = ${SHELL} /Users/plusvic/Projects/yara/missing --run aclocal-1.10
AMTAR = ${SHELL} /Users/plusvic/Projects/yara/missing --run tar
AUTOCONF = ${SHELL} /Users/plusvic/Projects/yara/missing --run autoconf
AUTOHEADER = ${SHELL} /Users/plusvic/Projects/yara/missing --run autoheader
AUTOMAKE = ${SHELL} /Users/plusvic/Projects/yara/missing --run automake-1.10
ACLOCAL = ${SHELL} /Users/plusvic/Projects/yara/trunk/missing --run aclocal-1.10
AMTAR = ${SHELL} /Users/plusvic/Projects/yara/trunk/missing --run tar
AUTOCONF = ${SHELL} /Users/plusvic/Projects/yara/trunk/missing --run autoconf
AUTOHEADER = ${SHELL} /Users/plusvic/Projects/yara/trunk/missing --run autoheader
AUTOMAKE = ${SHELL} /Users/plusvic/Projects/yara/trunk/missing --run automake-1.10
AWK = awk
CC = gcc
CCDEPMODE = depmode=gcc3
@@ -112,24 +112,24 @@ LDFLAGS =
LIBOBJS =
LIBS = -lpcre -lpcre -lpcre -lpcre
LTLIBOBJS =
MAKEINFO = ${SHELL} /Users/plusvic/Projects/yara/missing --run makeinfo
MAKEINFO = ${SHELL} /Users/plusvic/Projects/yara/trunk/missing --run makeinfo
MKDIR_P = ./install-sh -c -d
OBJEXT = o
PACKAGE = yara
PACKAGE_BUGREPORT = [email protected]
PACKAGE_NAME = yara
PACKAGE_STRING = yara 1.0
PACKAGE_STRING = yara 1.1
PACKAGE_TARNAME = yara
PACKAGE_VERSION = 1.0
PACKAGE_VERSION = 1.1
PATH_SEPARATOR = :
SET_MAKE =
SHELL = /bin/sh
STRIP =
VERSION = 1.0
abs_builddir = /Users/plusvic/Projects/yara
abs_srcdir = /Users/plusvic/Projects/yara
abs_top_builddir = /Users/plusvic/Projects/yara
abs_top_srcdir = /Users/plusvic/Projects/yara
VERSION = 1.1
abs_builddir = /Users/plusvic/Projects/yara/trunk
abs_srcdir = /Users/plusvic/Projects/yara/trunk
abs_top_builddir = /Users/plusvic/Projects/yara/trunk
abs_top_srcdir = /Users/plusvic/Projects/yara/trunk
ac_ct_CC = gcc
am__include = include
am__leading_dot = .
@@ -148,7 +148,7 @@ host_alias =
htmldir = ${docdir}
includedir = ${prefix}/include
infodir = ${datarootdir}/info
install_sh = $(SHELL) /Users/plusvic/Projects/yara/install-sh
install_sh = $(SHELL) /Users/plusvic/Projects/yara/trunk/install-sh
libdir = ${exec_prefix}/lib
libexecdir = ${exec_prefix}/libexec
localedir = ${datarootdir}/locale
config.h
+3 -3
View File
@@ -14,13 +14,13 @@
#define PACKAGE_NAME "yara"
/* Define to the full name and version of this package. */
#define PACKAGE_STRING "yara 1.0"
#define PACKAGE_STRING "yara 1.1"
/* Define to the one symbol short name of this package. */
#define PACKAGE_TARNAME "yara"
/* Define to the version of this package. */
#define PACKAGE_VERSION "1.0"
#define PACKAGE_VERSION "1.1"
/* Version number of package */
#define VERSION "1.0"
#define VERSION "1.1"
configure
Vendored
+10 -10
View File
@@ -1,6 +1,6 @@
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.61 for yara 1.0.
# Generated by GNU Autoconf 2.61 for yara 1.1.
#
# Report bugs to <[email protected]>.
#
@@ -574,8 +574,8 @@ SHELL=${CONFIG_SHELL-/bin/sh}
# Identity of this package.
PACKAGE_NAME='yara'
PACKAGE_TARNAME='yara'
PACKAGE_VERSION='1.0'
PACKAGE_STRING='yara 1.0'
PACKAGE_VERSION='1.1'
PACKAGE_STRING='yara 1.1'
PACKAGE_BUGREPORT='[email protected]'
ac_subst_vars='SHELL
@@ -1167,7 +1167,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
\`configure' configures yara 1.0 to adapt to many kinds of systems.
\`configure' configures yara 1.1 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@@ -1233,7 +1233,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
short | recursive ) echo "Configuration of yara 1.0:";;
short | recursive ) echo "Configuration of yara 1.1:";;
esac
cat <<\_ACEOF
@@ -1316,7 +1316,7 @@ fi
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
yara configure 1.0
yara configure 1.1
generated by GNU Autoconf 2.61
Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1330,7 +1330,7 @@ cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
It was created by yara $as_me 1.0, which was
It was created by yara $as_me 1.1, which was
generated by GNU Autoconf 2.61. Invocation command line was
$ $0 $@
@@ -2020,7 +2020,7 @@ fi
# Define the identity of the package.
PACKAGE='yara'
VERSION='1.0'
VERSION='1.1'
cat >>confdefs.h <<_ACEOF
@@ -3973,7 +3973,7 @@ exec 6>&1
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
This file was extended by yara $as_me 1.0, which was
This file was extended by yara $as_me 1.1, which was
generated by GNU Autoconf 2.61. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@@ -4026,7 +4026,7 @@ Report bugs to <[email protected]>."
_ACEOF
cat >>$CONFIG_STATUS <<_ACEOF
ac_cs_version="\\
yara config.status 1.0
yara config.status 1.1
configured by $0, generated by GNU Autoconf 2.61,
with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
configure.ac
+1 -1
View File
@@ -1,4 +1,4 @@
AC_INIT([yara], [1.0], [[email protected]])
AC_INIT([yara], [1.1], [[email protected]])
AM_INIT_AUTOMAKE([-Wall -Werror])
AC_PROG_CC
#AC_CHECK_LIB(yara,compile_rules,,AC_MSG_ERROR(yara not found))
doc/YARA User's Manual.pdf
BIN
View File
Binary file not shown.
extra/TextMate-bundle.zip
BIN
View File
Binary file not shown.
extra/YARA.tmbundle/Preferences/Typing Pairs.tmPreferences
-35
View File
@@ -1,35 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>name</key>
<string>Typing Pairs</string>
<key>settings</key>
<dict>
<key>highlightPairs</key>
<array>
<array>
<string>"</string>
<string>"</string>
</array>
<array>
<string>{</string>
<string>}</string>
</array>
</array>
<key>smartTypingPairs</key>
<array>
<array>
<string>"</string>
<string>"</string>
</array>
<array>
<string>{</string>
<string>}</string>
</array>
</array>
</dict>
<key>uuid</key>
<string>A9DBD3EB-C900-46BD-BFC6-1B663B04D53F</string>
</dict>
</plist>
extra/YARA.tmbundle/Snippets/rule.tmSnippet
-21
View File
@@ -1,21 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>content</key>
<string>rule ${1:identifier}
{
strings:
$3
condition:
$0
}</string>
<key>name</key>
<string>rule</string>
<key>tabTrigger</key>
<string>rule</string>
<key>uuid</key>
<string>37D903E5-F98B-48C3-AED3-A79518607E49</string>
</dict>
</plist>
extra/YARA.tmbundle/Syntaxes/MDL.tmLanguage
-132
View File
@@ -1,132 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>fileTypes</key>
<array/>
<key>foldingStartMarker</key>
<string>/\*\*|\{\s*$</string>
<key>foldingStopMarker</key>
<string>\*\*/|^\s*\}</string>
<key>name</key>
<string>YARA</string>
<key>patterns</key>
<array>
<dict>
<key>begin</key>
<string>/\*</string>
<key>captures</key>
<dict>
<key>0</key>
<dict>
<key>name</key>
<string>punctuation.definition.comment.yara</string>
</dict>
</dict>
<key>end</key>
<string>\*/</string>
<key>name</key>
<string>comment.block.yara</string>
</dict>
<dict>
<key>begin</key>
<string>//</string>
<key>beginCaptures</key>
<dict>
<key>0</key>
<dict>
<key>name</key>
<string>punctuation.definition.comment.yara</string>
</dict>
</dict>
<key>end</key>
<string>$\n?</string>
<key>name</key>
<string>comment.line.yara</string>
<key>patterns</key>
<array>
<dict>
<key>match</key>
<string>(?&gt;\\\s*\n)</string>
<key>name</key>
<string>punctuation.separator.continuation.yara</string>
</dict>
</array>
</dict>
<dict>
<key>match</key>
<string>\b(true|false|private|rule|strings|condition|and|or|not|filesize|in|at|rva|of|nocase|regexp|fullword|widechar|entrypoint)\b</string>
<key>name</key>
<string>keyword.yara</string>
</dict>
<dict>
<key>match</key>
<string>\b(0(x|X)[0-9a-fA-F]+)(MB|KB)?\b</string>
<key>name</key>
<string>constant.numeric.yara</string>
</dict>
<dict>
<key>match</key>
<string>(\$|#)[a-zA-Z0-9_]+\b</string>
<key>name</key>
<string>variable.other.yara</string>
</dict>
<dict>
<key>begin</key>
<string>"</string>
<key>beginCaptures</key>
<dict>
<key>0</key>
<dict>
<key>name</key>
<string>punctuation.definition.string.begin.yara</string>
</dict>
</dict>
<key>end</key>
<string>"</string>
<key>endCaptures</key>
<dict>
<key>0</key>
<dict>
<key>name</key>
<string>punctuation.definition.string.end.yara</string>
</dict>
</dict>
<key>name</key>
<string>string.quoted.double.yara</string>
<key>patterns</key>
<array>
<dict>
<key>include</key>
<string>#string_escaped_char</string>
</dict>
</array>
</dict>
</array>
<key>repository</key>
<dict>
<key>string_escaped_char</key>
<dict>
<key>patterns</key>
<array>
<dict>
<key>match</key>
<string>\\(\\|[t"]|[4-7]\d?|x[a-fA-F0-9]{,2})</string>
<key>name</key>
<string>constant.character.escape.yara</string>
</dict>
<dict>
<key>match</key>
<string>\\.</string>
<key>name</key>
<string>invalid.illegal.unknown-escape.yara</string>
</dict>
</array>
</dict>
</dict>
<key>scopeName</key>
<string>source.yara</string>
<key>uuid</key>
<string>B2FCEE68-87FA-45BA-BCAB-72EB9C9A0C3F</string>
</dict>
</plist>
extra/YARA.tmbundle/info.plist
-16
View File
@@ -1,16 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>name</key>
<string>YARA</string>
<key>ordering</key>
<array>
<string>B2FCEE68-87FA-45BA-BCAB-72EB9C9A0C3F</string>
<string>A9DBD3EB-C900-46BD-BFC6-1B663B04D53F</string>
<string>37D903E5-F98B-48C3-AED3-A79518607E49</string>
</array>
<key>uuid</key>
<string>1E30D5ED-9687-4F4E-8755-1B8D7403F549</string>
</dict>
</plist>
libyara/Makefile
+20 -20
View File
@@ -31,8 +31,8 @@ POST_INSTALL = :
NORMAL_UNINSTALL = :
PRE_UNINSTALL = :
POST_UNINSTALL = :
build_triplet = i386-apple-darwin9.5.0
host_triplet = i386-apple-darwin9.5.0
build_triplet = i386-apple-darwin9.6.0
host_triplet = i386-apple-darwin9.6.0
subdir = .
DIST_COMMON = README $(am__configure_deps) $(include_HEADERS) \
$(srcdir)/Makefile.am $(srcdir)/Makefile.in \
@@ -97,12 +97,12 @@ DIST_ARCHIVES = $(distdir).tar.gz
GZIP_ENV = --best
distuninstallcheck_listfiles = find . -type f -print
distcleancheck_listfiles = find . -type f -print
ACLOCAL = ${SHELL} /Users/plusvic/Projects/yara/libyara/missing --run aclocal-1.10
AMTAR = ${SHELL} /Users/plusvic/Projects/yara/libyara/missing --run tar
ACLOCAL = ${SHELL} /Users/plusvic/Projects/yara/trunk/libyara/missing --run aclocal-1.10
AMTAR = ${SHELL} /Users/plusvic/Projects/yara/trunk/libyara/missing --run tar
AR = ar
AUTOCONF = ${SHELL} /Users/plusvic/Projects/yara/libyara/missing --run autoconf
AUTOHEADER = ${SHELL} /Users/plusvic/Projects/yara/libyara/missing --run autoheader
AUTOMAKE = ${SHELL} /Users/plusvic/Projects/yara/libyara/missing --run automake-1.10
AUTOCONF = ${SHELL} /Users/plusvic/Projects/yara/trunk/libyara/missing --run autoconf
AUTOHEADER = ${SHELL} /Users/plusvic/Projects/yara/trunk/libyara/missing --run autoheader
AUTOMAKE = ${SHELL} /Users/plusvic/Projects/yara/trunk/libyara/missing --run automake-1.10
AWK = awk
CC = gcc
CCDEPMODE = depmode=gcc3
@@ -139,27 +139,27 @@ LIBS = -lpcre -lpcre -lpcre -lpcre
LIBTOOL = $(SHELL) $(top_builddir)/libtool
LN_S = ln -s
LTLIBOBJS =
MAKEINFO = ${SHELL} /Users/plusvic/Projects/yara/libyara/missing --run makeinfo
MAKEINFO = ${SHELL} /Users/plusvic/Projects/yara/trunk/libyara/missing --run makeinfo
MKDIR_P = ./install-sh -c -d
OBJEXT = o
PACKAGE = libyara
PACKAGE_BUGREPORT = [email protected]
PACKAGE_NAME = libyara
PACKAGE_STRING = libyara 1.0
PACKAGE_STRING = libyara 1.1
PACKAGE_TARNAME = libyara
PACKAGE_VERSION = 1.0
PACKAGE_VERSION = 1.1
PATH_SEPARATOR = :
RANLIB = ranlib
SET_MAKE =
SHELL = /bin/sh
STRIP = strip
VERSION = 1.0
VERSION = 1.1
YACC = bison -y
YFLAGS = -d
abs_builddir = /Users/plusvic/Projects/yara/libyara
abs_srcdir = /Users/plusvic/Projects/yara/libyara
abs_top_builddir = /Users/plusvic/Projects/yara/libyara
abs_top_srcdir = /Users/plusvic/Projects/yara/libyara
abs_builddir = /Users/plusvic/Projects/yara/trunk/libyara
abs_srcdir = /Users/plusvic/Projects/yara/trunk/libyara
abs_top_builddir = /Users/plusvic/Projects/yara/trunk/libyara
abs_top_srcdir = /Users/plusvic/Projects/yara/trunk/libyara
ac_ct_CC = gcc
ac_ct_CXX = g++
ac_ct_F77 =
@@ -169,10 +169,10 @@ am__quote =
am__tar = ${AMTAR} chof - "$$tardir"
am__untar = ${AMTAR} xf -
bindir = ${exec_prefix}/bin
build = i386-apple-darwin9.5.0
build = i386-apple-darwin9.6.0
build_alias =
build_cpu = i386
build_os = darwin9.5.0
build_os = darwin9.6.0
build_vendor = apple
builddir = .
datadir = ${datarootdir}
@@ -180,15 +180,15 @@ datarootdir = ${prefix}/share
docdir = ${datarootdir}/doc/${PACKAGE_TARNAME}
dvidir = ${docdir}
exec_prefix = ${prefix}
host = i386-apple-darwin9.5.0
host = i386-apple-darwin9.6.0
host_alias =
host_cpu = i386
host_os = darwin9.5.0
host_os = darwin9.6.0
host_vendor = apple
htmldir = ${docdir}
includedir = ${prefix}/include
infodir = ${datarootdir}/info
install_sh = $(SHELL) /Users/plusvic/Projects/yara/libyara/install-sh
install_sh = $(SHELL) /Users/plusvic/Projects/yara/trunk/libyara/install-sh
libdir = ${exec_prefix}/lib
libexecdir = ${exec_prefix}/libexec
localedir = ${datarootdir}/locale
libyara/ast.c
+23 -52
View File
@@ -158,7 +158,7 @@ int new_rule(RULE_LIST* rules, char* identifier, int flags, TAG* tag_list_head,
return result;
}
int new_hex_string(char* charstr, unsigned char** hexstr, unsigned char** maskstr, unsigned int* length)
int new_hex_string(SIZED_STRING* charstr, unsigned char** hexstr, unsigned char** maskstr, unsigned int* length)
{
int i;
int skip_lo;
@@ -178,7 +178,7 @@ int new_hex_string(char* charstr, unsigned char** hexstr, unsigned char** maskst
//assert(charstr && hexstr && maskstr && length);
len = (int) strlen(charstr);
len = (int) charstr->length;
//assert(charstr[0] == '{' && charstr[len - 1] == '}');
@@ -199,7 +199,7 @@ int new_hex_string(char* charstr, unsigned char** hexstr, unsigned char** maskst
while (i < len - 1)
{
c = toupper(charstr[i]);
c = toupper(charstr->c_string[i]);
if (c >= 'A' && c <= 'F')
{
@@ -273,7 +273,7 @@ int new_hex_string(char* charstr, unsigned char** hexstr, unsigned char** maskst
nibble_count = 0;
closing_bracket = strchr(charstr + i + 1, ']');
closing_bracket = strchr(charstr->c_string + i + 1, ']');
if (closing_bracket == NULL)
{
@@ -293,7 +293,7 @@ int new_hex_string(char* charstr, unsigned char** hexstr, unsigned char** maskst
/* only decimal digits and '-' are allowed between brackets */
for (s = charstr + i + 1; s < closing_bracket; s++)
for (s = charstr->c_string + i + 1; s < closing_bracket; s++)
{
if ((*s != '-') && (*s < '0' || *s > '9'))
{
@@ -302,7 +302,7 @@ int new_hex_string(char* charstr, unsigned char** hexstr, unsigned char** maskst
}
}
skip_lo = atoi(charstr + i + 1);
skip_lo = atoi(charstr->c_string + i + 1);
if (skip_lo < 0 || skip_lo > MASK_MAX_SKIP)
{
@@ -312,7 +312,7 @@ int new_hex_string(char* charstr, unsigned char** hexstr, unsigned char** maskst
skip_exact = 1;
s = strchr(charstr + i + 1, '-');
s = strchr(charstr->c_string + i + 1, '-');
if (s != NULL && s < closing_bracket)
{
@@ -339,7 +339,7 @@ int new_hex_string(char* charstr, unsigned char** hexstr, unsigned char** maskst
*mask++ = (unsigned char) skip_hi;
}
i = (int) (closing_bracket - charstr + 1);
i = (int) (closing_bracket - charstr->c_string + 1);
}
else if (c == ' ')
@@ -361,7 +361,7 @@ int new_hex_string(char* charstr, unsigned char** hexstr, unsigned char** maskst
*mask++ = MASK_END;
/* wildcards or skip instructions are not allowed at the first two bytes of the string */
/* wildcards or skip instructions are not allowed at the first position the string */
if ((*maskstr)[0] != 0xFF || (*maskstr)[1] != 0xFF)
{
@@ -384,46 +384,8 @@ int new_hex_string(char* charstr, unsigned char** hexstr, unsigned char** maskst
return result;
}
int validate_regexp(char* regexp)
{
int i = 0;
char* s = regexp;
while (*s != '\0' && i < 2)
{
if (*s == '\\') /* scaped char */
{
s += 2;
}
else
{
switch(*s)
{
case '(':
case ')':
case '[':
case ']':
case '{':
case '}':
case '.':
case '*':
case '+':
case '|':
case '$':
case '?':
return ERROR_INVALID_BEGINING_FOR_REGEXP;
}
s++;
}
i++;
}
return ERROR_SUCCESS;
}
int new_text_string(char* charstr, int flags, unsigned char** hexstr, pcre** regexp, unsigned int* length)
int new_text_string(SIZED_STRING* charstr, int flags, unsigned char** hexstr, pcre** regexp, unsigned int* length)
{
const char *error;
int erroffset;
@@ -432,8 +394,16 @@ int new_text_string(char* charstr, int flags, unsigned char** hexstr, pcre** reg
//assert(charstr && hexstr && regexp && length);
*length = (int) strlen(charstr);
*hexstr = (unsigned char*) strdup(charstr);
*length = charstr->length;
*hexstr = malloc(charstr->length);
if (*hexstr == NULL)
{
return ERROR_INSUFICIENT_MEMORY;
}
memcpy(*hexstr, charstr->c_string, charstr->length);
if (flags & STRING_FLAGS_REGEXP)
{
@@ -448,7 +418,7 @@ int new_text_string(char* charstr, int flags, unsigned char** hexstr, pcre** reg
if (*regexp != NULL)
{
result = validate_regexp((char*) *hexstr);
result = ERROR_SUCCESS;
}
else /* compilation failed */
{
@@ -465,7 +435,7 @@ int new_text_string(char* charstr, int flags, unsigned char** hexstr, pcre** reg
return result;
}
int new_string(char* identifier, char* charstr, int flags, STRING** string)
int new_string(char* identifier, SIZED_STRING* charstr, int flags, STRING** string)
{
STRING* new_string;
int result = ERROR_SUCCESS;
@@ -661,6 +631,7 @@ RULE_LIST* alloc_rule_list()
rule_list->head = NULL;
rule_list->tail = NULL;
rule_list->non_hashed_strings = NULL;
memset(rule_list->hash_table, 0, sizeof(rule_list->hash_table));
libyara/ast.h
+3 -2
View File
@@ -18,6 +18,7 @@ GNU General Public License for more details.
#define _AST_H
#include "yara.h"
#include "sizedstr.h"
#define MASK_EXACT_SKIP 0xCC
#define MASK_RANGE_SKIP 0xDD
@@ -49,7 +50,7 @@ GNU General Public License for more details.
#define TERM_TYPE_FILESIZE 22
#define TERM_TYPE_ENTRYPOINT 23
#define TERM_TYPE_RULE 24
#define TERM_TYPE_OF_THEM 25
typedef struct _TERM_CONST
@@ -90,7 +91,7 @@ typedef struct _TERM_STRING
int new_rule(RULE_LIST* rules, char* identifier, int flags, TAG* tag_list_head, STRING* string_list_head, TERM* condition);
int new_string(char* identifier, char* charstr, int flags, STRING** string);
int new_string(char* identifier, SIZED_STRING* charstr, int flags, STRING** string);
int new_simple_term(int type, TERM** term);
libyara/config.h
+3 -3
View File
@@ -44,19 +44,19 @@
#define PACKAGE_NAME "libyara"
/* Define to the full name and version of this package. */
#define PACKAGE_STRING "libyara 1.0"
#define PACKAGE_STRING "libyara 1.1"
/* Define to the one symbol short name of this package. */
#define PACKAGE_TARNAME "libyara"
/* Define to the version of this package. */
#define PACKAGE_VERSION "1.0"
#define PACKAGE_VERSION "1.1"
/* Define to 1 if you have the ANSI C header files. */
#define STDC_HEADERS 1
/* Version number of package */
#define VERSION "1.0"
#define VERSION "1.1"
/* Define to 1 if `lex' declares `yytext' as a `char *' by default, not a
`char[]'. */
libyara/configure
Vendored
+10 -10
View File
@@ -1,6 +1,6 @@
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.61 for libyara 1.0.
# Generated by GNU Autoconf 2.61 for libyara 1.1.
#
# Report bugs to <[email protected]>.
#
@@ -728,8 +728,8 @@ SHELL=${CONFIG_SHELL-/bin/sh}
# Identity of this package.
PACKAGE_NAME='libyara'
PACKAGE_TARNAME='libyara'
PACKAGE_VERSION='1.0'
PACKAGE_STRING='libyara 1.0'
PACKAGE_VERSION='1.1'
PACKAGE_STRING='libyara 1.1'
PACKAGE_BUGREPORT='[email protected]'
# Factoring default headers for most tests.
@@ -1396,7 +1396,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
\`configure' configures libyara 1.0 to adapt to many kinds of systems.
\`configure' configures libyara 1.1 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@@ -1466,7 +1466,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
short | recursive ) echo "Configuration of libyara 1.0:";;
short | recursive ) echo "Configuration of libyara 1.1:";;
esac
cat <<\_ACEOF
@@ -1573,7 +1573,7 @@ fi
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
libyara configure 1.0
libyara configure 1.1
generated by GNU Autoconf 2.61
Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1587,7 +1587,7 @@ cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
It was created by libyara $as_me 1.0, which was
It was created by libyara $as_me 1.1, which was
generated by GNU Autoconf 2.61. Invocation command line was
$ $0 $@
@@ -2277,7 +2277,7 @@ fi
# Define the identity of the package.
PACKAGE='libyara'
VERSION='1.0'
VERSION='1.1'
cat >>confdefs.h <<_ACEOF
@@ -20232,7 +20232,7 @@ exec 6>&1
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
This file was extended by libyara $as_me 1.0, which was
This file was extended by libyara $as_me 1.1, which was
generated by GNU Autoconf 2.61. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@@ -20285,7 +20285,7 @@ Report bugs to <[email protected]>."
_ACEOF
cat >>$CONFIG_STATUS <<_ACEOF
ac_cs_version="\\
libyara config.status 1.0
libyara config.status 1.1
configured by $0, generated by GNU Autoconf 2.61,
with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
libyara/configure.ac
+1 -1
View File
@@ -1,4 +1,4 @@
AC_INIT([libyara], [1.0], [[email protected]])
AC_INIT([libyara], [1.1], [[email protected]])
AM_INIT_AUTOMAKE([-Wall -Werror foreign])
AC_PROG_CC
AC_PROG_YACC
libyara/error.c
-4
View File
@@ -93,10 +93,6 @@ void show_last_error()
case ERROR_INVALID_REGULAR_EXPRESSION:
yyerror(last_error_extra_info);
break;
case ERROR_INVALID_BEGINING_FOR_REGEXP:
sprintf(errmsg, "invalid regular expression in string \"%s\": first two characters of regular expressions must be strictly defined", last_error_extra_info);
yyerror(errmsg);
break;
}
}
libyara/eval.c
+20
View File
@@ -23,6 +23,8 @@ unsigned int evaluate(TERM* term, EVALUATION_CONTEXT* context)
unsigned int i;
unsigned int offs, hi_bound, lo_bound;
STRING* string;
TERM_CONST* term_const = ((TERM_CONST*) term);
TERM_BINARY_OPERATION* term_binary = ((TERM_BINARY_OPERATION*) term);
TERM_STRING* term_string = ((TERM_STRING*) term);
@@ -161,6 +163,24 @@ unsigned int evaluate(TERM* term, EVALUATION_CONTEXT* context)
return (i == 0);
case TERM_TYPE_OF_THEM:
i = evaluate(term_binary->op1, context);
string = context->rule->string_list_head;
while (string != NULL && i > 0)
{
if (string->flags & STRING_FLAGS_FOUND)
{
i--;
}
string = string->next;
}
return (i == 0);
default:
return 0;
}
libyara/eval.h
+1
View File
@@ -23,6 +23,7 @@ typedef struct _EVALUATION_CONTEXT
{
unsigned int file_size;
unsigned int entry_point;
RULE* rule;
} EVALUATION_CONTEXT;
libyara/grammar.c
+360 -292
View File
File diff suppressed because it is too large Load Diff
libyara/grammar.h
+51 -46
View File
@@ -42,9 +42,9 @@
_UNKNOWN_ = 268,
_TEXTSTRING_ = 269,
_HEXSTRING_ = 270,
_WIDE_ = 271,
_NOCASE_ = 272,
_REGEXP_ = 273,
_REGEXP_ = 271,
_WIDE_ = 272,
_NOCASE_ = 273,
_FULLWORD_ = 274,
_AT_ = 275,
_SIZE_ = 276,
@@ -54,22 +54,23 @@
_FILE_ = 280,
_IN_ = 281,
_OF_ = 282,
_SECTION_ = 283,
_MZ_ = 284,
_PE_ = 285,
_DLL_ = 286,
_TRUE_ = 287,
_FALSE_ = 288,
_OR_ = 289,
_AND_ = 290,
_NOT_ = 291,
_IS_ = 292,
_NEQ_ = 293,
_EQ_ = 294,
_GE_ = 295,
_GT_ = 296,
_LE_ = 297,
_LT_ = 298
_THEM_ = 283,
_SECTION_ = 284,
_MZ_ = 285,
_PE_ = 286,
_DLL_ = 287,
_TRUE_ = 288,
_FALSE_ = 289,
_OR_ = 290,
_AND_ = 291,
_NOT_ = 292,
_IS_ = 293,
_NEQ_ = 294,
_EQ_ = 295,
_GE_ = 296,
_GT_ = 297,
_LE_ = 298,
_LT_ = 299
};
#endif
#define _RULE_ 258
@@ -85,9 +86,9 @@
#define _UNKNOWN_ 268
#define _TEXTSTRING_ 269
#define _HEXSTRING_ 270
#define _WIDE_ 271
#define _NOCASE_ 272
#define _REGEXP_ 273
#define _REGEXP_ 271
#define _WIDE_ 272
#define _NOCASE_ 273
#define _FULLWORD_ 274
#define _AT_ 275
#define _SIZE_ 276
@@ -97,37 +98,41 @@
#define _FILE_ 280
#define _IN_ 281
#define _OF_ 282
#define _SECTION_ 283
#define _MZ_ 284
#define _PE_ 285
#define _DLL_ 286
#define _TRUE_ 287
#define _FALSE_ 288
#define _OR_ 289
#define _AND_ 290
#define _NOT_ 291
#define _IS_ 292
#define _NEQ_ 293
#define _EQ_ 294
#define _GE_ 295
#define _GT_ 296
#define _LE_ 297
#define _LT_ 298
#define _THEM_ 283
#define _SECTION_ 284
#define _MZ_ 285
#define _PE_ 286
#define _DLL_ 287
#define _TRUE_ 288
#define _FALSE_ 289
#define _OR_ 290
#define _AND_ 291
#define _NOT_ 292
#define _IS_ 293
#define _NEQ_ 294
#define _EQ_ 295
#define _GE_ 296
#define _GT_ 297
#define _LE_ 298
#define _LT_ 299
#if ! defined (YYSTYPE) && ! defined (YYSTYPE_IS_DECLARED)
#line 97 "grammar.y"
typedef union YYSTYPE {
unsigned int integer;
char* pchar;
void* string;
void* term;
void* tag;
#line 75 "grammar.y"
typedef union YYSTYPE {
void* sized_string;
char* c_string;
unsigned int integer;
void* string;
void* term;
void* tag;
} YYSTYPE;
/* Line 1318 of yacc.c. */
#line 131 "grammar.h"
#line 136 "grammar.h"
# define yystype YYSTYPE /* obsolescent; will be withdrawn */
# define YYSTYPE_IS_DECLARED 1
# define YYSTYPE_IS_TRIVIAL 1
libyara/grammar.y
+85 -42
View File
@@ -7,34 +7,10 @@
#include "ast.h"
#include "error.h"
#include "compile.h"
#include "sizedstr.h"
#define YYERROR_VERBOSE
/* Global variables */
STRING* current_rule_strings;
/* Function declarations */
void reduce_rule_declaration(char* identifier, int flags, TAG* tag_list_head, STRING* string_list_head, TERM* condition);
TAG* reduce_tags(TAG* tag_list_head, char* identifier);
STRING* reduce_string_declaration(char* identifier, char* str, int flags);
STRING* reduce_strings(STRING* string_list_head, STRING* string);
TERM* reduce_string(char* identifier);
TERM* reduce_string_at(char* identifier, TERM* offset);
TERM* reduce_string_in_range(char* identifier, TERM* lower_offset, TERM* upper_offset);
TERM* reduce_string_in_section_by_name(char* identifier, char* section_name);
TERM* reduce_string_count(char* identifier);
TERM* reduce_filesize();
TERM* reduce_entrypoint();
TERM* reduce_term(int type, TERM* op1, TERM* op2);
TERM* reduce_constant(unsigned int constant);
TERM* reduce_rule(char* identifier);
TERM* reduce_boolean_expression_list(TERM* boolean_expression_list_head, TERM* boolean_expression);
%}
%token _RULE_
@@ -43,13 +19,14 @@ TERM* reduce_boolean_expression_list(TERM* boolean_expression_list_head, TERM* b
%token <string> _STRINGS_
%token _CONDITION_
%token _END_
%token <pchar> _IDENTIFIER_
%token <c_string> _IDENTIFIER_
%token <term> _STRING_IDENTIFIER_
%token <term> _STRING_COUNT_
%token <integer> _NUMBER_
%token _UNKNOWN_
%token <pchar> _TEXTSTRING_
%token <pchar> _HEXSTRING_
%token <sized_string> _TEXTSTRING_
%token <sized_string> _HEXSTRING_
%token <sized_string> _REGEXP_
%token _WIDE_
%token _NOCASE_
%token _REGEXP_
@@ -62,6 +39,7 @@ TERM* reduce_boolean_expression_list(TERM* boolean_expression_list_head, TERM* b
%token _FILE_
%token _IN_
%token _OF_
%token _THEM_
%token <term> _SECTION_
%token _MZ_
@@ -94,14 +72,49 @@ TERM* reduce_boolean_expression_list(TERM* boolean_expression_list_head, TERM* b
%type <term> boolean_expression_list
%type <term> boolean_expressions
%union {
unsigned int integer;
char* pchar;
void* string;
void* term;
void* tag;
};
%union {
void* sized_string;
char* c_string;
unsigned int integer;
void* string;
void* term;
void* tag;
}
%destructor { free ($$); } _TEXTSTRING_ _HEXSTRING_ _REGEXP_ _IDENTIFIER_
%{
/* Global variables */
STRING* current_rule_strings;
/* Function declarations */
void reduce_rule_declaration(char* identifier, int flags, TAG* tag_list_head, STRING* string_list_head, TERM* condition);
TAG* reduce_tags(TAG* tag_list_head, char* identifier);
STRING* reduce_string_declaration(char* identifier, SIZED_STRING* str, int flags);
STRING* reduce_strings(STRING* string_list_head, STRING* string);
TERM* reduce_string(char* identifier);
TERM* reduce_string_at(char* identifier, TERM* offset);
TERM* reduce_string_in_range(char* identifier, TERM* lower_offset, TERM* upper_offset);
TERM* reduce_string_in_section_by_name(char* identifier, SIZED_STRING* section_name);
TERM* reduce_string_count(char* identifier);
TERM* reduce_filesize();
TERM* reduce_entrypoint();
TERM* reduce_term(int type, TERM* op1, TERM* op2);
TERM* reduce_constant(unsigned int constant);
TERM* reduce_rule(char* identifier);
TERM* reduce_boolean_expression_list(TERM* boolean_expression_list_head, TERM* boolean_expression);
TERM* reduce_n_of_them(TERM* n);
%}
%%
@@ -186,6 +199,17 @@ string_declaration : _STRING_IDENTIFIER_ '=' _TEXTSTRING_ string_modifiers
YYERROR;
}
}
| _STRING_IDENTIFIER_ '=' _REGEXP_ string_modifiers
{
$$ = reduce_string_declaration($1, $3, $4 | STRING_FLAGS_REGEXP);
if ($$ == NULL)
{
show_last_error();
yynerrs++;
YYERROR;
}
}
| _STRING_IDENTIFIER_ '=' _HEXSTRING_
{
$$ = reduce_string_declaration($1, $3, STRING_FLAGS_HEXADECIMAL);
@@ -205,7 +229,6 @@ string_modifiers : /* empty */ { $$ = 0; }
string_modifier : _WIDE_ { $$ = STRING_FLAGS_WIDE; }
| _NOCASE_ { $$ = STRING_FLAGS_NO_CASE; }
| _REGEXP_ { $$ = STRING_FLAGS_REGEXP; }
| _FULLWORD_ { $$ = STRING_FLAGS_FULL_WORD; }
;
@@ -283,10 +306,9 @@ boolean_expression : _TRUE_ { $$ = reduce_consta
| expression _IS_ expression { $$ = reduce_term(TERM_TYPE_EQ, $1, $3); }
| expression _NEQ_ expression { $$ = reduce_term(TERM_TYPE_NOT_EQ, $1, $3); }
| number _OF_ boolean_expression_list { $$ = reduce_term(TERM_TYPE_OF, $1, $3); }
| number _OF_ _THEM_ { $$ = reduce_n_of_them($1); }
;
//TODO: controla que el numero en el operador OF sea menor o igual que la cantidad de elementos en la lista
boolean_expression_list : '(' boolean_expressions ')' { $$ = $2; }
;
@@ -360,11 +382,11 @@ void reduce_rule_declaration(char* identifier, int flags, TAG* tag_list_head, ST
}
}
STRING* reduce_string_declaration(char* identifier, char* str, int flags)
STRING* reduce_string_declaration(char* identifier, SIZED_STRING* str, int flags)
{
char tmp[200];
STRING* string = NULL;
last_error = new_string(identifier, str, flags, &string);
if (last_error == ERROR_INVALID_REGULAR_EXPRESSION)
@@ -514,7 +536,7 @@ TERM* reduce_string_in_range(char* identifier, TERM* lower_offset, TERM* upper_o
return (TERM*) term;
}
TERM* reduce_string_in_section_by_name(char* identifier, char* section_name)
TERM* reduce_string_in_section_by_name(char* identifier, SIZED_STRING* section_name)
{
TERM_STRING* term = NULL;
@@ -526,9 +548,10 @@ TERM* reduce_string_in_section_by_name(char* identifier, char* section_name)
}
else
{
term->section_name = section_name;
term->section_name = strdup(section_name->c_string);
}
free(section_name);
free(identifier);
return (TERM*) term;
}
@@ -576,6 +599,26 @@ TERM* reduce_boolean_expression_list(TERM* boolean_expression_list_head, TERM* b
return boolean_expression;
}
TERM* reduce_n_of_them(TERM* n)
{
STRING* string;
TERM_BINARY_OPERATION* term;
last_error = new_binary_operation(TERM_TYPE_OF_THEM, n, NULL, &term);
/* the keyword THEM implicitly references all the strings
on the rule, so let's flag them as referenced */
string = current_rule_strings;
while (string != NULL)
{
string->flags |= STRING_FLAGS_REFERENCED;
string = string->next;
}
return (TERM*) term;
}
libyara/lex.c
+309 -214
View File
@@ -285,28 +285,28 @@ static void yy_fatal_error YY_PROTO(( yyconst char msg[] ));
*yy_cp = '\0'; \
yy_c_buf_p = yy_cp;
#define YY_NUM_RULES 51
#define YY_END_OF_BUFFER 52
static yyconst short int yy_accept[164] =
#define YY_NUM_RULES 56
#define YY_END_OF_BUFFER 57
static yyconst short int yy_accept[170] =
{ 0,
0, 0, 0, 0, 52, 50, 48, 49, 50, 38,
34, 33, 50, 36, 36, 1, 50, 2, 35, 35,
0, 0, 0, 0, 0, 0, 57, 55, 53, 54,
55, 38, 34, 33, 47, 36, 36, 1, 55, 2,
35, 35, 35, 35, 35, 35, 35, 35, 35, 35,
35, 35, 50, 44, 45, 39, 51, 6, 34, 33,
0, 0, 36, 0, 0, 0, 3, 5, 4, 35,
35, 21, 35, 35, 35, 35, 35, 35, 22, 29,
35, 23, 20, 35, 35, 35, 35, 35, 35, 35,
35, 0, 44, 46, 41, 42, 40, 46, 0, 0,
0, 32, 36, 37, 19, 35, 35, 35, 35, 35,
35, 35, 18, 35, 35, 35, 35, 26, 35, 35,
35, 35, 35, 35, 55, 44, 45, 39, 56, 50,
51, 48, 50, 6, 34, 33, 0, 0, 36, 0,
0, 0, 3, 5, 4, 35, 35, 20, 35, 35,
35, 35, 35, 35, 21, 29, 35, 22, 19, 35,
35, 35, 35, 35, 35, 35, 35, 0, 44, 46,
41, 42, 40, 46, 50, 49, 0, 0, 0, 32,
36, 37, 18, 35, 35, 35, 35, 35, 35, 35,
35, 35, 47, 0, 31, 35, 35, 35, 28, 35,
35, 35, 35, 35, 35, 9, 35, 35, 16, 35,
43, 35, 35, 17, 35, 35, 35, 35, 35, 35,
35, 35, 35, 35, 35, 35, 35, 35, 8, 13,
27, 35, 14, 35, 35, 35, 35, 35, 35, 35,
7, 30, 10, 35, 35, 35, 25, 12, 11, 15,
35, 24, 0
17, 35, 35, 35, 26, 35, 35, 35, 35, 35,
52, 0, 31, 35, 35, 35, 28, 35, 35, 35,
35, 35, 9, 35, 35, 23, 15, 35, 43, 35,
35, 16, 35, 35, 35, 35, 35, 35, 35, 35,
35, 35, 35, 35, 35, 8, 13, 27, 35, 35,
35, 35, 35, 35, 35, 35, 7, 30, 10, 35,
35, 35, 25, 12, 11, 14, 35, 24, 0
} ;
static yyconst int yy_ec[256] =
@@ -322,9 +322,9 @@ static yyconst int yy_ec[256] =
19, 19, 19, 19, 19, 19, 19, 19, 19, 19,
10, 22, 10, 1, 23, 1, 24, 25, 26, 27,
28, 29, 30, 31, 32, 19, 19, 33, 19, 34,
35, 36, 19, 37, 38, 39, 40, 41, 42, 43,
44, 45, 46, 1, 47, 1, 1, 1, 1, 1,
28, 29, 30, 31, 32, 19, 19, 33, 34, 35,
36, 37, 19, 38, 39, 40, 41, 42, 43, 44,
45, 46, 47, 1, 48, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
@@ -341,125 +341,135 @@ static yyconst int yy_ec[256] =
1, 1, 1, 1, 1
} ;
static yyconst int yy_meta[48] =
static yyconst int yy_meta[49] =
{ 0,
1, 1, 2, 3, 1, 2, 1, 1, 1, 3,
1, 4, 4, 1, 1, 1, 4, 4, 5, 5,
5, 2, 6, 4, 4, 4, 4, 4, 4, 5,
5, 5, 5, 5, 5, 5, 5, 5, 5, 5,
5, 5, 5, 5, 5, 1, 1
1, 1, 2, 3, 1, 4, 1, 1, 1, 3,
5, 6, 6, 1, 1, 1, 6, 6, 7, 7,
7, 4, 8, 6, 6, 6, 6, 6, 6, 7,
7, 7, 7, 7, 7, 7, 7, 7, 7, 7,
7, 7, 7, 7, 7, 7, 1, 1
} ;
static yyconst short int yy_base[176] =
static yyconst short int yy_base[184] =
{ 0,
0, 0, 45, 46, 221, 222, 222, 222, 205, 222,
0, 0, 44, 44, 49, 204, 203, 202, 0, 20,
181, 181, 26, 181, 37, 178, 43, 175, 45, 35,
174, 178, 0, 0, 222, 222, 54, 222, 0, 0,
200, 205, 69, 189, 188, 0, 222, 222, 222, 0,
178, 0, 170, 164, 169, 168, 167, 164, 0, 0,
52, 169, 0, 165, 166, 162, 170, 167, 155, 151,
163, 142, 0, 222, 222, 222, 222, 0, 179, 176,
183, 222, 222, 0, 0, 158, 147, 145, 154, 148,
155, 155, 0, 140, 136, 148, 147, 0, 135, 141,
0, 0, 46, 47, 48, 51, 250, 251, 251, 251,
234, 251, 0, 0, 46, 51, 54, 233, 232, 231,
0, 21, 209, 209, 52, 210, 42, 206, 49, 203,
38, 54, 27, 208, 0, 0, 251, 251, 77, 0,
251, 251, 228, 251, 0, 0, 229, 234, 76, 218,
217, 0, 251, 251, 251, 0, 207, 0, 198, 192,
198, 197, 196, 192, 0, 0, 60, 198, 0, 194,
192, 200, 197, 184, 193, 179, 192, 170, 0, 251,
251, 251, 251, 0, 0, 251, 208, 205, 212, 251,
251, 0, 0, 187, 175, 173, 183, 177, 184, 184,
144, 143, 222, 0, 222, 138, 125, 140, 129, 124,
141, 126, 135, 138, 118, 0, 128, 125, 0, 132,
222, 118, 120, 0, 123, 119, 120, 124, 112, 111,
113, 113, 117, 115, 113, 109, 98, 105, 0, 0,
0, 113, 0, 106, 101, 114, 102, 82, 68, 68,
0, 0, 0, 57, 58, 54, 0, 0, 0, 0,
45, 0, 222, 97, 100, 102, 104, 108, 112, 118,
124, 130, 79, 75, 73
0, 168, 164, 177, 0, 164, 171, 168, 173, 172,
251, 0, 251, 167, 153, 169, 157, 152, 170, 154,
164, 167, 0, 158, 154, 0, 0, 143, 251, 126,
115, 0, 118, 111, 113, 92, 79, 78, 80, 85,
83, 81, 76, 65, 72, 0, 0, 0, 81, 73,
68, 82, 69, 72, 75, 75, 0, 0, 0, 63,
63, 57, 0, 0, 0, 0, 51, 0, 251, 121,
129, 132, 134, 136, 142, 148, 156, 164, 172, 180,
84, 79, 54
} ;
static yyconst short int yy_def[176] =
static yyconst short int yy_def[184] =
{ 0,
163, 1, 164, 164, 163, 163, 163, 163, 163, 163,
165, 166, 163, 163, 163, 163, 163, 163, 167, 167,
167, 167, 167, 167, 167, 167, 167, 167, 167, 167,
167, 167, 168, 169, 163, 163, 170, 163, 165, 166,
171, 172, 163, 163, 163, 173, 163, 163, 163, 167,
167, 167, 167, 167, 167, 167, 167, 167, 167, 167,
167, 167, 167, 167, 167, 167, 167, 167, 167, 167,
167, 168, 169, 163, 163, 163, 163, 174, 171, 171,
172, 163, 163, 173, 167, 167, 167, 167, 167, 167,
167, 167, 167, 167, 167, 167, 167, 167, 167, 167,
169, 1, 170, 170, 171, 171, 169, 169, 169, 169,
169, 169, 172, 173, 169, 169, 169, 169, 169, 169,
174, 174, 174, 174, 174, 174, 174, 174, 174, 174,
174, 174, 174, 174, 175, 176, 169, 169, 177, 178,
169, 169, 178, 169, 172, 173, 179, 180, 169, 169,
169, 181, 169, 169, 169, 174, 174, 174, 174, 174,
174, 174, 174, 174, 174, 174, 174, 174, 174, 174,
174, 174, 174, 174, 174, 174, 174, 175, 176, 169,
169, 169, 169, 182, 178, 169, 179, 179, 180, 169,
169, 181, 174, 174, 174, 174, 174, 174, 174, 174,
167, 167, 163, 175, 163, 167, 167, 167, 167, 167,
167, 167, 167, 167, 167, 167, 167, 167, 167, 167,
163, 167, 167, 167, 167, 167, 167, 167, 167, 167,
167, 167, 167, 167, 167, 167, 167, 167, 167, 167,
167, 167, 167, 167, 167, 167, 167, 167, 167, 167,
167, 167, 167, 167, 167, 167, 167, 167, 167, 167,
167, 167, 0, 163, 163, 163, 163, 163, 163, 163,
163, 163, 163, 163, 163
174, 174, 174, 174, 174, 174, 174, 174, 174, 174,
169, 183, 169, 174, 174, 174, 174, 174, 174, 174,
174, 174, 174, 174, 174, 174, 174, 174, 169, 174,
174, 174, 174, 174, 174, 174, 174, 174, 174, 174,
174, 174, 174, 174, 174, 174, 174, 174, 174, 174,
174, 174, 174, 174, 174, 174, 174, 174, 174, 174,
174, 174, 174, 174, 174, 174, 174, 174, 0, 169,
169, 169, 169, 169, 169, 169, 169, 169, 169, 169,
169, 169, 169
} ;
static yyconst short int yy_nxt[270] =
static yyconst short int yy_nxt[300] =
{ 0,
6, 7, 8, 7, 9, 10, 11, 12, 6, 6,
13, 14, 15, 16, 17, 18, 19, 19, 19, 19,
19, 6, 19, 20, 19, 21, 19, 22, 23, 24,
19, 25, 19, 26, 27, 28, 29, 30, 31, 19,
19, 32, 19, 19, 19, 33, 6, 35, 35, 55,
36, 36, 41, 51, 42, 43, 43, 56, 52, 75,
43, 43, 68, 44, 45, 57, 37, 37, 44, 45,
59, 62, 65, 69, 60, 76, 121, 92, 104, 63,
43, 43, 84, 162, 66, 67, 46, 161, 44, 45,
93, 160, 77, 159, 158, 157, 78, 34, 34, 34,
8, 9, 10, 9, 11, 12, 13, 14, 8, 8,
15, 16, 17, 18, 19, 20, 21, 21, 21, 21,
21, 8, 21, 22, 21, 23, 21, 24, 25, 26,
21, 27, 21, 21, 28, 29, 30, 31, 32, 33,
21, 21, 34, 21, 21, 21, 35, 8, 37, 37,
41, 38, 38, 41, 47, 57, 48, 75, 42, 129,
58, 42, 49, 49, 76, 49, 49, 39, 39, 43,
50, 51, 43, 50, 51, 61, 65, 68, 71, 72,
66, 73, 81, 62, 112, 100, 69, 49, 49, 92,
168, 167, 63, 74, 52, 50, 51, 166, 82, 101,
34, 34, 34, 39, 39, 40, 40, 50, 50, 50,
72, 72, 73, 156, 73, 73, 73, 73, 74, 74,
74, 74, 74, 74, 79, 79, 79, 79, 79, 79,
81, 81, 81, 81, 81, 81, 155, 154, 153, 152,
151, 150, 149, 148, 147, 146, 145, 144, 143, 142,
141, 140, 139, 138, 137, 136, 135, 134, 133, 132,
131, 130, 129, 128, 127, 126, 125, 124, 123, 122,
120, 119, 118, 117, 116, 115, 114, 113, 112, 111,
110, 109, 108, 107, 106, 82, 105, 80, 103, 102,
101, 100, 99, 98, 97, 96, 95, 94, 91, 90,
165, 164, 163, 162, 161, 160, 159, 158, 157, 156,
155, 154, 153, 152, 151, 150, 83, 149, 148, 147,
84, 36, 36, 36, 36, 36, 36, 36, 36, 40,
40, 40, 40, 40, 40, 40, 40, 45, 45, 46,
46, 56, 56, 56, 78, 146, 145, 78, 79, 144,
79, 143, 79, 79, 79, 79, 80, 80, 80, 80,
80, 80, 80, 80, 85, 142, 85, 85, 141, 85,
85, 85, 87, 87, 87, 87, 87, 87, 87, 87,
89, 89, 89, 89, 89, 89, 89, 89, 140, 139,
138, 137, 136, 135, 134, 133, 132, 131, 130, 128,
127, 126, 125, 124, 123, 122, 121, 120, 119, 118,
117, 116, 115, 114, 90, 113, 88, 111, 110, 109,
108, 107, 106, 105, 104, 103, 102, 99, 98, 97,
96, 95, 94, 93, 91, 91, 90, 88, 86, 77,
70, 67, 64, 60, 59, 55, 54, 53, 44, 169,
7, 169, 169, 169, 169, 169, 169, 169, 169, 169,
169, 169, 169, 169, 169, 169, 169, 169, 169, 169,
169, 169, 169, 169, 169, 169, 169, 169, 169, 169,
169, 169, 169, 169, 169, 169, 169, 169, 169, 169,
169, 169, 169, 169, 169, 169, 169, 169, 169
89, 88, 87, 86, 85, 83, 83, 82, 80, 71,
70, 64, 61, 58, 54, 53, 49, 48, 47, 38,
163, 5, 163, 163, 163, 163, 163, 163, 163, 163,
163, 163, 163, 163, 163, 163, 163, 163, 163, 163,
163, 163, 163, 163, 163, 163, 163, 163, 163, 163,
163, 163, 163, 163, 163, 163, 163, 163, 163, 163,
163, 163, 163, 163, 163, 163, 163, 163, 163
} ;
static yyconst short int yy_chk[270] =
static yyconst short int yy_chk[300] =
{ 0,
1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 3, 4, 23,
3, 4, 13, 20, 13, 14, 14, 23, 20, 37,
15, 15, 30, 14, 14, 23, 3, 4, 15, 15,
25, 27, 29, 30, 25, 37, 175, 61, 174, 27,
43, 43, 173, 161, 29, 29, 14, 156, 43, 43,
61, 155, 37, 154, 150, 149, 37, 164, 164, 164,
1, 1, 1, 1, 1, 1, 1, 1, 3, 4,
5, 3, 4, 6, 15, 22, 15, 33, 5, 183,
22, 6, 16, 16, 33, 17, 17, 3, 4, 5,
16, 16, 6, 17, 17, 25, 27, 29, 31, 31,
27, 32, 39, 25, 182, 67, 29, 49, 49, 181,
167, 162, 25, 32, 16, 49, 49, 161, 39, 67,
164, 164, 164, 165, 165, 166, 166, 167, 167, 167,
168, 168, 169, 148, 169, 169, 169, 169, 170, 170,
170, 170, 170, 170, 171, 171, 171, 171, 171, 171,
172, 172, 172, 172, 172, 172, 147, 146, 145, 144,
142, 138, 137, 136, 135, 134, 133, 132, 131, 130,
129, 128, 127, 126, 125, 123, 122, 120, 118, 117,
115, 114, 113, 112, 111, 110, 109, 108, 107, 106,
102, 101, 100, 99, 97, 96, 95, 94, 92, 91,
90, 89, 88, 87, 86, 81, 80, 79, 72, 71,
70, 69, 68, 67, 66, 65, 64, 62, 58, 57,
160, 156, 155, 154, 153, 152, 151, 150, 149, 145,
144, 143, 142, 141, 140, 139, 39, 138, 137, 136,
39, 170, 170, 170, 170, 170, 170, 170, 170, 171,
171, 171, 171, 171, 171, 171, 171, 172, 172, 173,
173, 174, 174, 174, 175, 135, 134, 175, 176, 133,
176, 131, 176, 176, 176, 176, 177, 177, 177, 177,
177, 177, 177, 177, 178, 130, 178, 178, 128, 178,
178, 178, 179, 179, 179, 179, 179, 179, 179, 179,
180, 180, 180, 180, 180, 180, 180, 180, 125, 124,
122, 121, 120, 119, 118, 117, 116, 115, 114, 110,
109, 108, 107, 106, 104, 103, 102, 100, 99, 98,
97, 96, 95, 94, 89, 88, 87, 78, 77, 76,
75, 74, 73, 72, 71, 70, 68, 64, 63, 62,
61, 60, 59, 57, 51, 50, 48, 47, 43, 34,
30, 28, 26, 24, 23, 20, 19, 18, 11, 7,
169, 169, 169, 169, 169, 169, 169, 169, 169, 169,
169, 169, 169, 169, 169, 169, 169, 169, 169, 169,
169, 169, 169, 169, 169, 169, 169, 169, 169, 169,
169, 169, 169, 169, 169, 169, 169, 169, 169, 169,
169, 169, 169, 169, 169, 169, 169, 169, 169
56, 55, 54, 53, 51, 45, 44, 42, 41, 32,
31, 28, 26, 24, 22, 21, 18, 17, 16, 9,
5, 163, 163, 163, 163, 163, 163, 163, 163, 163,
163, 163, 163, 163, 163, 163, 163, 163, 163, 163,
163, 163, 163, 163, 163, 163, 163, 163, 163, 163,
163, 163, 163, 163, 163, 163, 163, 163, 163, 163,
163, 163, 163, 163, 163, 163, 163, 163, 163
} ;
static yy_state_type yy_last_accepting_state;
@@ -486,8 +496,10 @@ char *yytext;
#include "error.h"
#include "xtoi.h"
char string_buf[255];
char string_buf[256];
char *string_buf_ptr;
unsigned short string_buf_len;
#ifdef WIN32
#define strdup _strdup
@@ -495,7 +507,9 @@ char *string_buf_ptr;
#define str 1
#line 499 "lex.c"
#define regexp 2
#line 513 "lex.c"
/* Macros after this point can all be overridden by user definitions in
* section 1.
@@ -646,10 +660,10 @@ YY_DECL
register char *yy_cp, *yy_bp;
register int yy_act;
#line 30 "lex.l"
#line 33 "lex.l"
#line 653 "lex.c"
#line 667 "lex.c"
if ( yy_init )
{
@@ -700,13 +714,13 @@ yy_match:
while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
{
yy_current_state = (int) yy_def[yy_current_state];
if ( yy_current_state >= 164 )
if ( yy_current_state >= 170 )
yy_c = yy_meta[(unsigned int) yy_c];
}
yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
++yy_cp;
}
while ( yy_base[yy_current_state] != 222 );
while ( yy_base[yy_current_state] != 251 );
yy_find_action:
yy_act = yy_accept[yy_current_state];
@@ -734,157 +748,157 @@ do_action: /* This label is used only to access EOF actions. */
case 1:
YY_RULE_SETUP
#line 32 "lex.l"
#line 35 "lex.l"
{ return _LT_; }
YY_BREAK
case 2:
YY_RULE_SETUP
#line 33 "lex.l"
#line 36 "lex.l"
{ return _GT_; }
YY_BREAK
case 3:
YY_RULE_SETUP
#line 34 "lex.l"
#line 37 "lex.l"
{ return _LE_; }
YY_BREAK
case 4:
YY_RULE_SETUP
#line 35 "lex.l"
#line 38 "lex.l"
{ return _GE_; }
YY_BREAK
case 5:
YY_RULE_SETUP
#line 36 "lex.l"
#line 39 "lex.l"
{ return _EQ_; }
YY_BREAK
case 6:
YY_RULE_SETUP
#line 37 "lex.l"
#line 40 "lex.l"
{ return _NEQ_; }
YY_BREAK
case 7:
YY_RULE_SETUP
#line 38 "lex.l"
#line 41 "lex.l"
{ return _PRIVATE_; }
YY_BREAK
case 8:
YY_RULE_SETUP
#line 39 "lex.l"
#line 42 "lex.l"
{ return _GLOBAL_; }
YY_BREAK
case 9:
YY_RULE_SETUP
#line 40 "lex.l"
#line 43 "lex.l"
{ return _RULE_; }
YY_BREAK
case 10:
YY_RULE_SETUP
#line 41 "lex.l"
#line 44 "lex.l"
{ return _STRINGS_; }
YY_BREAK
case 11:
YY_RULE_SETUP
#line 42 "lex.l"
#line 45 "lex.l"
{ return _WIDE_; }
YY_BREAK
case 12:
YY_RULE_SETUP
#line 43 "lex.l"
#line 46 "lex.l"
{ return _FULLWORD_; }
YY_BREAK
case 13:
YY_RULE_SETUP
#line 44 "lex.l"
#line 47 "lex.l"
{ return _NOCASE_; }
YY_BREAK
case 14:
YY_RULE_SETUP
#line 45 "lex.l"
{ return _REGEXP_; }
#line 48 "lex.l"
{ return _CONDITION_; }
YY_BREAK
case 15:
YY_RULE_SETUP
#line 46 "lex.l"
{ return _CONDITION_; }
#line 49 "lex.l"
{ return _TRUE_; }
YY_BREAK
case 16:
YY_RULE_SETUP
#line 47 "lex.l"
{ return _TRUE_; }
#line 50 "lex.l"
{ return _FALSE_; }
YY_BREAK
case 17:
YY_RULE_SETUP
#line 48 "lex.l"
{ return _FALSE_; }
#line 51 "lex.l"
{ return _NOT_; }
YY_BREAK
case 18:
YY_RULE_SETUP
#line 49 "lex.l"
{ return _NOT_; }
#line 52 "lex.l"
{ return _AND_; }
YY_BREAK
case 19:
YY_RULE_SETUP
#line 50 "lex.l"
{ return _AND_; }
#line 53 "lex.l"
{ return _OR_; }
YY_BREAK
case 20:
YY_RULE_SETUP
#line 51 "lex.l"
{ return _OR_; }
#line 54 "lex.l"
{ return _AT_; }
YY_BREAK
case 21:
YY_RULE_SETUP
#line 52 "lex.l"
{ return _AT_; }
#line 55 "lex.l"
{ return _IN_; }
YY_BREAK
case 22:
YY_RULE_SETUP
#line 53 "lex.l"
{ return _IN_; }
#line 56 "lex.l"
{ return _OF_; }
YY_BREAK
case 23:
YY_RULE_SETUP
#line 54 "lex.l"
{ return _OF_; }
#line 57 "lex.l"
{ return _THEM_; }
YY_BREAK
case 24:
YY_RULE_SETUP
#line 55 "lex.l"
#line 58 "lex.l"
{ return _ENTRYPOINT_; }
YY_BREAK
case 25:
YY_RULE_SETUP
#line 56 "lex.l"
#line 59 "lex.l"
{ return _SIZE_; }
YY_BREAK
case 26:
YY_RULE_SETUP
#line 57 "lex.l"
#line 60 "lex.l"
{ return _RVA_; }
YY_BREAK
case 27:
YY_RULE_SETUP
#line 58 "lex.l"
#line 61 "lex.l"
{ return _OFFSET_; }
YY_BREAK
case 28:
YY_RULE_SETUP
#line 59 "lex.l"
#line 62 "lex.l"
{ return _FILE_; }
YY_BREAK
case 29:
YY_RULE_SETUP
#line 60 "lex.l"
#line 63 "lex.l"
{ return _IS_; }
YY_BREAK
case 30:
YY_RULE_SETUP
#line 61 "lex.l"
#line 64 "lex.l"
{ return _SECTION_; }
YY_BREAK
case 31:
YY_RULE_SETUP
#line 64 "lex.l"
#line 67 "lex.l"
{ /* skip comments */
char* line_break = strchr( yytext, '\n' );
@@ -898,7 +912,7 @@ YY_RULE_SETUP
YY_BREAK
case 32:
YY_RULE_SETUP
#line 75 "lex.l"
#line 78 "lex.l"
{ /* skip single-line comments */
line_number++;
@@ -906,24 +920,24 @@ YY_RULE_SETUP
YY_BREAK
case 33:
YY_RULE_SETUP
#line 80 "lex.l"
#line 83 "lex.l"
{
yylval.pchar = (char*) strdup(yytext);
yylval.c_string = (char*) strdup(yytext);
return _STRING_IDENTIFIER_;
}
YY_BREAK
case 34:
YY_RULE_SETUP
#line 85 "lex.l"
#line 88 "lex.l"
{
yylval.pchar = (char*) strdup(yytext);
yylval.pchar[0] = '$'; /* replace # by $*/
yylval.c_string = (char*) strdup(yytext);
yylval.c_string[0] = '$'; /* replace # by $*/
return _STRING_COUNT_;
}
YY_BREAK
case 35:
YY_RULE_SETUP
#line 91 "lex.l"
#line 94 "lex.l"
{
if (strlen(yytext) > 128)
{
@@ -931,13 +945,13 @@ YY_RULE_SETUP
yynerrs++;
}
yylval.pchar = (char*) strdup(yytext);
yylval.c_string = (char*) strdup(yytext);
return _IDENTIFIER_;
}
YY_BREAK
case 36:
YY_RULE_SETUP
#line 102 "lex.l"
#line 105 "lex.l"
{
yylval.integer = (unsigned int) atoi(yytext);
@@ -955,7 +969,7 @@ YY_RULE_SETUP
YY_BREAK
case 37:
YY_RULE_SETUP
#line 117 "lex.l"
#line 120 "lex.l"
{
yylval.integer = xtoi(yytext + 2);
return _NUMBER_;
@@ -963,74 +977,82 @@ YY_RULE_SETUP
YY_BREAK
case 38:
YY_RULE_SETUP
#line 123 "lex.l"
#line 126 "lex.l"
{
string_buf_ptr = string_buf;
string_buf_len = 0;
BEGIN(str);
}
YY_BREAK
case 39:
YY_RULE_SETUP
#line 128 "lex.l"
#line 132 "lex.l"
{ /* saw closing quote - all done */
int len;
if (string_buf_len == 0)
{
yyerror("empty string");
yynerrs++;
}
*string_buf_ptr = '\0';
BEGIN(INITIAL);
*string_buf_ptr = '\0';
len = strlen(string_buf);
SIZED_STRING* s = (SIZED_STRING*) malloc(string_buf_len + sizeof(SIZED_STRING));
yylval.pchar = strdup(string_buf);
s->length = string_buf_len;
memcpy(s->c_string, string_buf, string_buf_len);
yylval.sized_string = s;
return _TEXTSTRING_;
}
YY_BREAK
case 40:
YY_RULE_SETUP
#line 142 "lex.l"
*string_buf_ptr++ = '\t';
#line 155 "lex.l"
{ *string_buf_ptr++ = '\t'; string_buf_len++; }
YY_BREAK
case 41:
YY_RULE_SETUP
#line 143 "lex.l"
*string_buf_ptr++ = '\"';
#line 156 "lex.l"
{ *string_buf_ptr++ = '\"'; string_buf_len++; }
YY_BREAK
case 42:
YY_RULE_SETUP
#line 144 "lex.l"
*string_buf_ptr++ = '\\';
#line 157 "lex.l"
{ *string_buf_ptr++ = '\\'; string_buf_len++; }
YY_BREAK
case 43:
YY_RULE_SETUP
#line 146 "lex.l"
#line 159 "lex.l"
{
int result;
sscanf( yytext + 2, "%x", &result );
if (result == 0)
{
yyerror("illegal escape sequence");
yynerrs++;
}
*string_buf_ptr++ = result;
string_buf_len++;
}
YY_BREAK
case 44:
YY_RULE_SETUP
#line 160 "lex.l"
#line 168 "lex.l"
{
char *yptr = yytext;
while ( *yptr )
{
*string_buf_ptr++ = *yptr++;
string_buf_len++;
}
}
YY_BREAK
case 45:
YY_RULE_SETUP
#line 167 "lex.l"
#line 178 "lex.l"
{
yyerror("unterminated string");
yyterminate();
@@ -1039,7 +1061,7 @@ YY_RULE_SETUP
YY_BREAK
case 46:
YY_RULE_SETUP
#line 173 "lex.l"
#line 184 "lex.l"
{
yyerror("illegal escape sequence");
yynerrs++;
@@ -1047,40 +1069,113 @@ YY_RULE_SETUP
YY_BREAK
case 47:
YY_RULE_SETUP
#line 180 "lex.l"
{
yylval.pchar = (char*) strdup(yytext);
return _HEXSTRING_;
}
#line 189 "lex.l"
{
string_buf_ptr = string_buf;
string_buf_len = 0;
BEGIN(regexp);
}
YY_BREAK
case 48:
YY_RULE_SETUP
#line 186 "lex.l"
/* skip whitespace */
#line 196 "lex.l"
{
if (string_buf_len == 0)
{
yyerror("empty regular expression");
yynerrs++;
}
*string_buf_ptr = '\0';
BEGIN(INITIAL);
SIZED_STRING* s = (SIZED_STRING*) malloc(string_buf_len + sizeof(SIZED_STRING));
s->length = string_buf_len;
memcpy(s->c_string, string_buf, string_buf_len);
yylval.sized_string = s;
return _REGEXP_;
}
YY_BREAK
case 49:
YY_RULE_SETUP
#line 188 "lex.l"
#line 220 "lex.l"
{ *string_buf_ptr++ = '/'; string_buf_len++; }
YY_BREAK
case 50:
YY_RULE_SETUP
#line 222 "lex.l"
{
char *yptr = yytext;
while ( *yptr )
{
*string_buf_ptr++ = *yptr++;
string_buf_len++;
}
}
YY_BREAK
case 51:
YY_RULE_SETUP
#line 232 "lex.l"
{
yyerror("unterminated regular expression");
yyterminate();
yynerrs++;
}
YY_BREAK
case 52:
YY_RULE_SETUP
#line 240 "lex.l"
{
int len = strlen(yytext);
SIZED_STRING* s = (SIZED_STRING*) malloc(len + sizeof(SIZED_STRING));
s->length = len;
strcpy(s->c_string, yytext);
yylval.sized_string = s;
return _HEXSTRING_;
}
YY_BREAK
case 53:
YY_RULE_SETUP
#line 255 "lex.l"
/* skip whitespace */
YY_BREAK
case 54:
YY_RULE_SETUP
#line 257 "lex.l"
{
line_number++;
}
YY_BREAK
case 50:
case 55:
YY_RULE_SETUP
#line 193 "lex.l"
#line 262 "lex.l"
{
return yytext[0];
}
YY_BREAK
case 51:
case 56:
YY_RULE_SETUP
#line 196 "lex.l"
#line 265 "lex.l"
ECHO;
YY_BREAK
#line 1082 "lex.c"
#line 1176 "lex.c"
case YY_STATE_EOF(INITIAL):
case YY_STATE_EOF(str):
case YY_STATE_EOF(regexp):
yyterminate();
case YY_END_OF_BUFFER:
@@ -1371,7 +1466,7 @@ static yy_state_type yy_get_previous_state()
while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
{
yy_current_state = (int) yy_def[yy_current_state];
if ( yy_current_state >= 164 )
if ( yy_current_state >= 170 )
yy_c = yy_meta[(unsigned int) yy_c];
}
yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
@@ -1406,11 +1501,11 @@ yy_state_type yy_current_state;
while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
{
yy_current_state = (int) yy_def[yy_current_state];
if ( yy_current_state >= 164 )
if ( yy_current_state >= 170 )
yy_c = yy_meta[(unsigned int) yy_c];
}
yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
yy_is_jam = (yy_current_state == 163);
yy_is_jam = (yy_current_state == 169);
return yy_is_jam ? 0 : yy_current_state;
}
@@ -1965,7 +2060,7 @@ int main()
return 0;
}
#endif
#line 196 "lex.l"
#line 265 "lex.l"
libyara/lex.l
+89 -20
View File
@@ -10,8 +10,10 @@
#include "error.h"
#include "xtoi.h"
char string_buf[255];
char string_buf[256];
char *string_buf_ptr;
unsigned short string_buf_len;
#ifdef WIN32
#define strdup _strdup
@@ -22,6 +24,7 @@ char *string_buf_ptr;
%option noyywrap
%x str
%x regexp
digit [0-9]
letter [a-zA-Z]
@@ -42,7 +45,6 @@ hexdigit [a-fA-F0-9]
"widechar" { return _WIDE_; }
"fullword" { return _FULLWORD_; }
"nocase" { return _NOCASE_; }
"regexp" { return _REGEXP_; }
"condition" { return _CONDITION_; }
"true" { return _TRUE_; }
"false" { return _FALSE_; }
@@ -52,6 +54,7 @@ hexdigit [a-fA-F0-9]
"at" { return _AT_; }
"in" { return _IN_; }
"of" { return _OF_; }
"them" { return _THEM_; }
"entrypoint" { return _ENTRYPOINT_; }
"filesize" { return _SIZE_; }
"rva" { return _RVA_; }
@@ -78,13 +81,13 @@ hexdigit [a-fA-F0-9]
}
$({letter}|{digit})* {
yylval.pchar = (char*) strdup(yytext);
yylval.c_string = (char*) strdup(yytext);
return _STRING_IDENTIFIER_;
}
#({letter}|{digit})* {
yylval.pchar = (char*) strdup(yytext);
yylval.pchar[0] = '$'; /* replace # by $*/
yylval.c_string = (char*) strdup(yytext);
yylval.c_string[0] = '$'; /* replace # by $*/
return _STRING_COUNT_;
}
@@ -95,7 +98,7 @@ $({letter}|{digit})* {
yynerrs++;
}
yylval.pchar = (char*) strdup(yytext);
yylval.c_string = (char*) strdup(yytext);
return _IDENTIFIER_;
}
@@ -122,46 +125,54 @@ $({letter}|{digit})* {
\" {
string_buf_ptr = string_buf;
string_buf_len = 0;
BEGIN(str);
}
<str>\" { /* saw closing quote - all done */
int len;
if (string_buf_len == 0)
{
yyerror("empty string");
yynerrs++;
}
*string_buf_ptr = '\0';
BEGIN(INITIAL);
*string_buf_ptr = '\0';
len = strlen(string_buf);
SIZED_STRING* s = (SIZED_STRING*) malloc(string_buf_len + sizeof(SIZED_STRING));
yylval.pchar = strdup(string_buf);
s->length = string_buf_len;
memcpy(s->c_string, string_buf, string_buf_len);
yylval.sized_string = s;
return _TEXTSTRING_;
}
<str>\\t *string_buf_ptr++ = '\t';
<str>\\\" *string_buf_ptr++ = '\"';
<str>\\\\ *string_buf_ptr++ = '\\';
<str>\\t { *string_buf_ptr++ = '\t'; string_buf_len++; }
<str>\\\" { *string_buf_ptr++ = '\"'; string_buf_len++; }
<str>\\\\ { *string_buf_ptr++ = '\\'; string_buf_len++; }
<str>\\x{hexdigit}{2} {
int result;
sscanf( yytext + 2, "%x", &result );
if (result == 0)
{
yyerror("illegal escape sequence");
yynerrs++;
}
*string_buf_ptr++ = result;
string_buf_len++;
}
<str>[^\\\n\"]+ {
char *yptr = yytext;
while ( *yptr )
{
*string_buf_ptr++ = *yptr++;
string_buf_len++;
}
}
<str>\n {
@@ -175,10 +186,68 @@ $({letter}|{digit})* {
yynerrs++;
}
"/" {
string_buf_ptr = string_buf;
string_buf_len = 0;
BEGIN(regexp);
}
<regexp>"/" {
if (string_buf_len == 0)
{
yyerror("empty regular expression");
yynerrs++;
}
*string_buf_ptr = '\0';
BEGIN(INITIAL);
SIZED_STRING* s = (SIZED_STRING*) malloc(string_buf_len + sizeof(SIZED_STRING));
s->length = string_buf_len;
memcpy(s->c_string, string_buf, string_buf_len);
yylval.sized_string = s;
return _REGEXP_;
}
<regexp>"\\/" { *string_buf_ptr++ = '/'; string_buf_len++; }
<regexp>[^/\n]+ {
char *yptr = yytext;
while ( *yptr )
{
*string_buf_ptr++ = *yptr++;
string_buf_len++;
}
}
<regexp>\n {
yyerror("unterminated regular expression");
yyterminate();
yynerrs++;
}
\{({hexdigit}|[ \?\[\]-])+\} {
yylval.pchar = (char*) strdup(yytext);
int len = strlen(yytext);
SIZED_STRING* s = (SIZED_STRING*) malloc(len + sizeof(SIZED_STRING));
s->length = len;
strcpy(s->c_string, yytext);
yylval.sized_string = s;
return _HEXSTRING_;
}
libyara/libtool
+9 -9
View File
@@ -1,7 +1,7 @@
#! /bin/sh
# libtoolT - Provide generalized library-building support services.
# Generated automatically by (GNU libyara 1.0)
# Generated automatically by (GNU libyara 1.1)
# NOTE: Changes made to this file will be lost: look at ltmain.sh.
#
# Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001
@@ -66,13 +66,13 @@ fast_install=needless
# The host system.
host_alias=
host=i386-apple-darwin9.5.0
host_os=darwin9.5.0
host=i386-apple-darwin9.6.0
host_os=darwin9.6.0
# The build system.
build_alias=
build=i386-apple-darwin9.5.0
build_os=darwin9.5.0
build=i386-apple-darwin9.6.0
build_os=darwin9.6.0
# An echo program that does not interpret backslashes.
echo="/bin/echo"
@@ -7234,13 +7234,13 @@ fast_install=needless
# The host system.
host_alias=
host=i386-apple-darwin9.5.0
host_os=darwin9.5.0
host=i386-apple-darwin9.6.0
host_os=darwin9.6.0
# The build system.
build_alias=
build=i386-apple-darwin9.5.0
build_os=darwin9.5.0
build=i386-apple-darwin9.6.0
build_os=darwin9.6.0
# An echo program that does not interpret backslashes.
echo="/bin/echo"
libyara/libyara.tmproj
+311 -61
View File
@@ -3,7 +3,7 @@
<plist version="1.0">
<dict>
<key>currentDocument</key>
<string>ast.c</string>
<string>scan.c</string>
<key>documents</key>
<array>
<dict>
@@ -13,59 +13,63 @@
<key>filename</key>
<string>scan.c</string>
<key>lastUsed</key>
<date>2008-09-25T16:53:02Z</date>
</dict>
<dict>
<key>filename</key>
<string>pefile.c</string>
<key>lastUsed</key>
<date>2008-07-16T11:44:54Z</date>
</dict>
<dict>
<key>filename</key>
<string>grammar.c</string>
</dict>
<dict>
<key>filename</key>
<string>filemap.c</string>
<key>lastUsed</key>
<date>2008-07-15T19:42:19Z</date>
</dict>
<dict>
<key>filename</key>
<string>eval.c</string>
<key>lastUsed</key>
<date>2008-07-15T19:42:17Z</date>
</dict>
<dict>
<key>filename</key>
<string>error.c</string>
<key>lastUsed</key>
<date>2008-07-15T19:39:58Z</date>
</dict>
<dict>
<key>filename</key>
<string>compile.c</string>
<key>lastUsed</key>
<date>2008-09-25T16:53:09Z</date>
</dict>
<dict>
<key>filename</key>
<string>ast.c</string>
<key>lastUsed</key>
<date>2008-09-25T16:53:09Z</date>
<date>2008-12-18T15:06:36Z</date>
<key>selected</key>
<true/>
</dict>
<dict>
<key>filename</key>
<string>pefile.c</string>
<key>lastUsed</key>
<date>2008-12-18T13:41:19Z</date>
</dict>
<dict>
<key>filename</key>
<string>filemap.c</string>
<key>lastUsed</key>
<date>2008-12-16T14:05:52Z</date>
</dict>
<dict>
<key>filename</key>
<string>eval.c</string>
<key>lastUsed</key>
<date>2008-12-18T13:39:44Z</date>
</dict>
<dict>
<key>filename</key>
<string>error.c</string>
<key>lastUsed</key>
<date>2008-12-18T12:33:29Z</date>
</dict>
<dict>
<key>filename</key>
<string>compile.c</string>
<key>lastUsed</key>
<date>2008-12-17T12:58:51Z</date>
</dict>
<dict>
<key>filename</key>
<string>ast.c</string>
<key>lastUsed</key>
<date>2008-12-18T12:58:08Z</date>
</dict>
<dict>
<key>filename</key>
<string>lex.l</string>
<key>lastUsed</key>
<date>2008-12-18T13:41:12Z</date>
</dict>
<dict>
<key>filename</key>
<string>grammar.y</string>
<key>lastUsed</key>
<date>2008-07-17T08:33:38Z</date>
<date>2008-12-18T15:06:36Z</date>
</dict>
<dict>
<key>filename</key>
<string>../yara.c</string>
<key>lastUsed</key>
<date>2008-12-18T12:06:48Z</date>
</dict>
</array>
<key>expanded</key>
@@ -80,13 +84,13 @@
<key>filename</key>
<string>yara.h</string>
<key>lastUsed</key>
<date>2008-07-17T18:49:33Z</date>
<date>2008-12-18T13:01:29Z</date>
</dict>
<dict>
<key>filename</key>
<string>pefile.h</string>
<key>lastUsed</key>
<date>2008-07-15T19:52:33Z</date>
<date>2008-12-17T13:30:13Z</date>
</dict>
<dict>
<key>filename</key>
@@ -98,37 +102,43 @@
<key>filename</key>
<string>grammar.h</string>
<key>lastUsed</key>
<date>2008-07-15T19:52:56Z</date>
<date>2008-12-16T13:59:06Z</date>
</dict>
<dict>
<key>filename</key>
<string>filemap.h</string>
<key>lastUsed</key>
<date>2008-07-15T19:52:55Z</date>
<date>2008-12-16T14:43:41Z</date>
</dict>
<dict>
<key>filename</key>
<string>eval.h</string>
<key>lastUsed</key>
<date>2008-07-15T20:51:18Z</date>
<date>2008-12-18T12:45:27Z</date>
</dict>
<dict>
<key>filename</key>
<string>error.h</string>
<key>lastUsed</key>
<date>2008-07-16T11:09:47Z</date>
<date>2008-12-17T19:14:52Z</date>
</dict>
<dict>
<key>filename</key>
<string>compile.h</string>
<key>lastUsed</key>
<date>2008-07-15T19:52:49Z</date>
<date>2008-12-16T19:03:53Z</date>
</dict>
<dict>
<key>filename</key>
<string>ast.h</string>
<key>lastUsed</key>
<date>2008-07-15T19:52:47Z</date>
<date>2008-12-18T13:01:14Z</date>
</dict>
<dict>
<key>filename</key>
<string>sizedstr.h</string>
<key>lastUsed</key>
<date>2008-12-18T12:06:30Z</date>
</dict>
</array>
<key>expanded</key>
@@ -141,21 +151,93 @@
<integer>200</integer>
<key>metaData</key>
<dict>
<key>../yara.c</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>15</integer>
<key>line</key>
<integer>281</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>419</integer>
</dict>
<key>ast.c</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>23</integer>
<integer>42</integer>
<key>line</key>
<integer>476</integer>
<integer>552</integer>
</dict>
<key>columnSelection</key>
<false/>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>518</integer>
<key>selectFrom</key>
<dict>
<key>column</key>
<integer>19</integer>
<key>line</key>
<integer>552</integer>
</dict>
<key>selectTo</key>
<dict>
<key>column</key>
<integer>42</integer>
<key>line</key>
<integer>552</integer>
</dict>
</dict>
<key>ast.h</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>33</integer>
<key>line</key>
<integer>52</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>707</integer>
<integer>62</integer>
</dict>
<key>compile.c</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>4</integer>
<key>line</key>
<integer>38</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>1</integer>
</dict>
<key>error.c</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>9</integer>
<key>line</key>
<integer>94</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>53</integer>
</dict>
<key>error.h</key>
<dict>
<key>caret</key>
<dict>
@@ -167,32 +249,200 @@
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>10</integer>
<integer>0</integer>
</dict>
<key>eval.c</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>0</integer>
<key>line</key>
<integer>92</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>66</integer>
</dict>
<key>eval.h</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>15</integer>
<key>line</key>
<integer>25</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>0</integer>
</dict>
<key>filemap.c</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>0</integer>
<key>line</key>
<integer>0</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>0</integer>
</dict>
<key>filemap.h</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>0</integer>
<key>line</key>
<integer>0</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>0</integer>
</dict>
<key>grammar.h</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>16</integer>
<key>line</key>
<integer>123</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>91</integer>
</dict>
<key>grammar.y</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>0</integer>
<key>line</key>
<integer>311</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>580</integer>
</dict>
<key>lex.l</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>32</integer>
<key>line</key>
<integer>254</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>210</integer>
</dict>
<key>pefile.c</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>0</integer>
<key>line</key>
<integer>0</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>0</integer>
</dict>
<key>scan.c</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>21</integer>
<integer>2</integer>
<key>line</key>
<integer>570</integer>
<integer>0</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>562</integer>
<integer>674</integer>
</dict>
<key>sizedstr.h</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>31</integer>
<key>line</key>
<integer>22</integer>
</dict>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>0</integer>
</dict>
<key>yara.h</key>
<dict>
<key>caret</key>
<dict>
<key>column</key>
<integer>8</integer>
<key>line</key>
<integer>36</integer>
</dict>
<key>columnSelection</key>
<false/>
<key>firstVisibleColumn</key>
<integer>0</integer>
<key>firstVisibleLine</key>
<integer>20</integer>
<key>selectFrom</key>
<dict>
<key>column</key>
<integer>31</integer>
<key>line</key>
<integer>36</integer>
</dict>
<key>selectTo</key>
<dict>
<key>column</key>
<integer>8</integer>
<key>line</key>
<integer>36</integer>
</dict>
</dict>
</dict>
<key>openDocuments</key>
<array>
<string>scan.c</string>
<string>compile.c</string>
<string>ast.h</string>
<string>ast.c</string>
<string>error.c</string>
<string>error.h</string>
<string>scan.c</string>
<string>sizedstr.h</string>
<string>lex.l</string>
<string>../yara.c</string>
<string>yara.h</string>
<string>pefile.c</string>
<string>eval.c</string>
<string>eval.h</string>
<string>grammar.y</string>
<string>compile.c</string>
<string>filemap.c</string>
</array>
<key>showFileHierarchyDrawer</key>
<true/>
<key>windowFrame</key>
<string>{{243, 4}, {1037, 774}}</string>
<string>{{214, 79}, {1020, 911}}</string>
</dict>
</plist>
libyara/scan.c
+188 -113
View File
@@ -43,8 +43,11 @@ int compare(char* str1, char* str2, int len)
char* s2 = str2;
int i = 0;
while (*s1++ == *s2++ && i < len) i++;
while (*s1++ == *s2++ && i < len)
{
i++;
}
return ((i==len) ? i : 0);
}
@@ -169,25 +172,13 @@ int regexp_match(unsigned char* buffer, unsigned int buffer_size, unsigned char*
char* s;
result = 0;
len = 0;
while (len < buffer_size)
{
if (buffer[len] < 32 || buffer[len] > 126) /* only printable characters */
{
break;
}
len++;
}
/*
negative_size > 0 indicates that it is safe to access buffer[-1],
if a previous printable char exists and pattern begins with ^ the
string doesn't match.
negative_size > 0 indicates that we are not at the beginning of the file,
therefore if pattern begins with ^ the string doesn't match
*/
if (negative_size > 0 && buffer[-1] >= 32 && buffer[-1] <= 126 && pattern[0] == '^')
if (negative_size > 0 && pattern[0] == '^')
{
return 0;
}
@@ -196,7 +187,7 @@ int regexp_match(unsigned char* buffer, unsigned int buffer_size, unsigned char*
regexp, /* the compiled pattern */
NULL, /* no extra data - we didn't study the pattern */
(char*) buffer, /* the subject string */
len, /* the length of the subject */
buffer_size, /* the length of the subject */
0, /* start at offset 0 in the subject */
0, /* default options */
ovector, /* output vector for substring information */
@@ -230,63 +221,79 @@ int init_hash_table(RULE_LIST* rule_list)
STRING_LIST_ENTRY* entry;
unsigned char x,y;
int next;
char hashable;
rule = rule_list->head;
while (rule != NULL)
{
string = rule->string_list_head;
while (string != NULL)
{
{
if (string->flags & STRING_FLAGS_REGEXP)
{
/* take into account scaped characters and ^ at beginning of regular expressions */
/* take into account anchors (^) at beginning of regular expressions */
if (string->string[0] == '\\' || string->string[0] == '^')
if (string->string[0] == '^')
{
x = string->string[1];
next = 2;
if (string->length > 2)
{
x = string->string[1];
y = string->string[2];
}
else
{
x = 0;
y = 0;
}
}
else
{
x = string->string[0];
next = 1;
y = string->string[1];
}
if (string->string[next] == '\\')
{
y = string->string[next + 1];
}
else
{
y = string->string[next];
}
hashable = isalnum(x) && isalnum(y);
}
else
{
x = string->string[0];
x = string->string[0];
y = string->string[1];
hashable = TRUE;
}
if (string->flags & STRING_FLAGS_NO_CASE)
if (string->flags & STRING_FLAGS_HEXADECIMAL)
{
hashable = (string->mask[0] == 0xFF) && (string->mask[1] == 0xFF);
}
if (hashable && string->flags & STRING_FLAGS_NO_CASE)
{
x = tolower(x);
y = tolower(y);
}
entry = (STRING_LIST_ENTRY*) malloc(sizeof(STRING_LIST_ENTRY));
if (entry != NULL)
{
entry->string = string;
entry->next = rule_list->hash_table[x][y]; /* insert new entry at begining of list */
rule_list->hash_table[x][y] = entry;
if (entry == NULL)
{
return ERROR_INSUFICIENT_MEMORY;
}
entry->string = string;
if (hashable)
{
entry->next = rule_list->hash_table[x][y]; /* insert new entry at begining of list */
rule_list->hash_table[x][y] = entry;
}
else
{
return ERROR_INSUFICIENT_MEMORY;
}
entry->next = rule_list->non_hashed_strings;
rule_list->non_hashed_strings = entry;
}
string = string->next;
}
@@ -319,6 +326,17 @@ void free_hash_table(RULE_LIST* rule_list)
rule_list->hash_table[i][j] = NULL;
}
}
entry = rule_list->non_hashed_strings;
while (entry != NULL)
{
next_entry = entry->next;
free(entry);
entry = next_entry;
}
rule_list->non_hashed_strings = NULL;
}
void clear_marks(RULE_LIST* rule_list)
@@ -332,7 +350,8 @@ void clear_marks(RULE_LIST* rule_list)
while (rule != NULL)
{
string = rule->string_list_head;
rule->flags &= ~RULE_FLAGS_MATCH;
string = rule->string_list_head;
while (string != NULL)
{
@@ -402,7 +421,7 @@ int string_match(unsigned char* buffer, unsigned int buffer_size, STRING* string
match = regexp_match(tmp, len, string->string, string->length, string->regexp, (negative_size > 2) ? 1 : 0);
free(tmp);
return match;
return match * 2;
}
}
@@ -457,7 +476,7 @@ int string_match(unsigned char* buffer, unsigned int buffer_size, STRING* string
{
match = compare((char*) string->string, (char*) buffer, string->length);
}
if (match > 0 && IS_FULL_WORD(string))
{
if (negative_size >= 1 && isalnum((char) (buffer[-1])))
@@ -476,6 +495,78 @@ int string_match(unsigned char* buffer, unsigned int buffer_size, STRING* string
return 0;
}
int find_matches_for_strings( STRING_LIST_ENTRY* first_string,
unsigned char* buffer,
unsigned int buffer_size,
unsigned int current_file_offset,
int wide,
int no_case,
int negative_size)
{
int len;
int overlap;
STRING* string;
MATCH* match;
STRING_LIST_ENTRY* entry = first_string;
while (entry != NULL)
{
string = entry->string;
if ((!wide || IS_WIDE(string)) &&
(!no_case || IS_NO_CASE(string)) &&
(len = string_match(buffer, buffer_size, string, negative_size)))
{
/* If this string already matched we must check that this match is not
overlapping a previous one. This can occur for example if we search
for the string 'aa' and the file contains 'aaaaaa'.
*/
overlap = FALSE;
if (string->flags && STRING_FLAGS_FOUND)
{
match = string->matches;
while(match != NULL)
{
if (match->offset + match->length > current_file_offset)
{
overlap = TRUE;
break;
}
match = match->next;
}
}
if (!overlap)
{
string->flags |= STRING_FLAGS_FOUND;
match = (MATCH*) malloc(sizeof(MATCH));
if (match != NULL)
{
match->offset = current_file_offset;
match->length = len;
match->next = string->matches;
string->matches = match;
}
else
{
return ERROR_INSUFICIENT_MEMORY;
}
}
}
entry = entry->next;
}
return ERROR_SUCCESS;
}
int find_matches( unsigned char first_char,
unsigned char second_char,
unsigned char* buffer,
@@ -488,77 +579,57 @@ int find_matches( unsigned char first_char,
unsigned char first_char_lower;
unsigned char second_char_lower;
int len;
int result;
STRING* string;
MATCH* match;
STRING_LIST_ENTRY* entry;
entry = rule_list->hash_table[first_char][second_char];
/* case sensitive */
while (entry != NULL)
{
string = entry->string;
if ((!wide || IS_WIDE(string)) && (len = string_match(buffer, buffer_size, string, negative_size)))
{
string->flags |= STRING_FLAGS_FOUND;
match = (MATCH*) malloc(sizeof(MATCH));
if (match != NULL)
{
match->offset = current_file_offset;
match->length = len;
match->next = string->matches;
string->matches = match;
}
else
{
return ERROR_INSUFICIENT_MEMORY;
}
}
entry = entry->next;
}
result = find_matches_for_strings( rule_list->hash_table[first_char][second_char],
buffer,
buffer_size,
current_file_offset,
wide,
FALSE,
negative_size);
if (result == ERROR_SUCCESS)
{
result = find_matches_for_strings( rule_list->non_hashed_strings,
buffer,
buffer_size,
current_file_offset,
wide,
FALSE,
negative_size);
}
/* case insensitive */
first_char_lower = tolower(first_char);
second_char_lower = tolower(second_char);
if (first_char_lower != first_char || second_char_lower != second_char)
if (result == ERROR_SUCCESS && (first_char_lower != first_char || second_char_lower != second_char))
{
entry = rule_list->hash_table[first_char_lower][second_char_lower];
while (entry != NULL)
{
string = entry->string;
if ((!wide || IS_WIDE(string)) &&
(string->flags & STRING_FLAGS_NO_CASE) &&
(len = string_match(buffer, buffer_size, string, negative_size)))
{
string->flags |= STRING_FLAGS_FOUND;
match = (MATCH*) malloc(sizeof(MATCH));
if (match != NULL)
{
match->offset = current_file_offset;
match->length = len;
match->next = string->matches;
string->matches = match;
}
else
{
return ERROR_INSUFICIENT_MEMORY;
}
}
entry = entry->next;
}
result = find_matches_for_strings( rule_list->hash_table[first_char_lower][second_char_lower],
buffer,
buffer_size,
current_file_offset,
wide,
TRUE,
negative_size);
if (result == ERROR_SUCCESS)
{
result = find_matches_for_strings( rule_list->non_hashed_strings,
buffer,
buffer_size,
current_file_offset,
wide,
TRUE,
negative_size);
}
}
return ERROR_SUCCESS;
return result;
}
int scan_mem(unsigned char* buffer, unsigned int buffer_size, RULE_LIST* rule_list, YARACALLBACK callback, void* user_data)
@@ -612,12 +683,16 @@ int scan_mem(unsigned char* buffer, unsigned int buffer_size, RULE_LIST* rule_li
continue;
}
context.rule = rule;
if (evaluate(rule->condition, &context))
{
if (callback(rule, buffer, buffer_size, user_data) != 0)
{
return ERROR_CALLBACK_ERROR;
}
rule->flags |= RULE_FLAGS_MATCH;
}
if (callback(rule, buffer, buffer_size, user_data) != 0)
{
return ERROR_CALLBACK_ERROR;
}
rule = rule->next;
libyara/sizedstr.h
+33
View File
@@ -0,0 +1,33 @@
/*
Copyright(c) 2007. Victor M. Alvarez [[email protected]].
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2, or (at your option)
any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
*/
#ifndef _SIZEDSTR_H
#define _SIZEDSTR_H
//
// This struct is used to support strings containing null chars. The length of
// the string is stored along the string data. However the string data is also
// terminated with a null char.
//
typedef struct _SIZED_STRING
{
int length;
char c_string[1];
} SIZED_STRING;
#endif
libyara/yara.h
+7 -7
View File
@@ -59,7 +59,7 @@ GNU General Public License for more details.
#endif
#define ERROR_INSUFICIENT_MEMORY 1
#define ERROR_DUPLICATERULEIDENTIFIER 2
#define ERROR_DUPLICATERULEIDENTIFIER 2
#define ERROR_INVALID_CHAR_IN_HEX_STRING 3
#define ERROR_MISMATCHED_BRACKET 4
#define ERROR_SKIP_AT_END 5
@@ -71,12 +71,11 @@ GNU General Public License for more details.
#define ERROR_UNDEFINED_RULE 11
#define ERROR_COULD_NOT_OPEN_FILE 12
#define ERROR_INVALID_REGULAR_EXPRESSION 13
#define ERROR_INVALID_BEGINING_FOR_REGEXP 14
#define ERROR_SYNTAX_ERROR 15
#define ERROR_DUPLICATE_TAG_IDENTIFIER 16
#define ERROR_UNREFERENCED_STRING 17
#define ERROR_DUPLICATE_STRING_IDENTIFIER 18
#define ERROR_CALLBACK_ERROR 19
#define ERROR_SYNTAX_ERROR 14
#define ERROR_DUPLICATE_TAG_IDENTIFIER 15
#define ERROR_UNREFERENCED_STRING 16
#define ERROR_DUPLICATE_STRING_IDENTIFIER 17
#define ERROR_CALLBACK_ERROR 18
typedef struct _MATCH
{
@@ -146,6 +145,7 @@ typedef struct _RULE_LIST
RULE* head;
RULE* tail;
STRING_LIST_ENTRY* hash_table[256][256];
STRING_LIST_ENTRY* non_hashed_strings;
} RULE_LIST;
yara.c
+60 -24
View File
@@ -36,6 +36,8 @@ int recursive_search = FALSE;
int show_tags = FALSE;
int show_specified_tags = FALSE;
int show_strings = FALSE;
int negate = FALSE;
TAG* specified_tag_list = NULL;
@@ -43,13 +45,14 @@ TAG* specified_tag_list = NULL;
void show_help()
{
printf("usage: yara [ -t tag ] [ -g ] [ -s ] [ -r ] [ -v ] [RULEFILE...] FILE\n");
printf("usage: yara [ -t tag ] [ -g ] [ -s ] [ -r ] [ -n ] [ -v ] [RULEFILE...] FILE\n");
printf("options:\n");
printf(" -t <tag> Display rules tagged as <tag> and ignore the rest. This option can be used more than once.\n");
printf(" -g Display tags.\n");
printf(" -s Display strings.\n");
printf(" -r Recursively search directories.\n");
printf(" -v Show version information.\n");
printf(" -t <tag> print rules tagged as <tag> and ignore the rest. This option can be used more than once.\n");
printf(" -n print rules that doesn't apply (negate).\n");
printf(" -g print tags.\n");
printf(" -s print strings.\n");
printf(" -r recursively search directories.\n");
printf(" -v show version information.\n");
printf("\nReport bugs to: <%s>\n", PACKAGE_BUGREPORT);
}
@@ -160,22 +163,43 @@ void scan_dir(const char* dir, int recursive, RULE_LIST* rules, YARACALLBACK cal
#endif
void print_string(unsigned char* buffer, unsigned int buffer_size, unsigned int offset, unsigned int length)
void print_string(unsigned char* buffer, unsigned int buffer_size, unsigned int offset, unsigned int length, int unicode)
{
int i = offset;
int len = 0;
char* tmp;
tmp = malloc(length + 1);
int i;
char* str;
memcpy(tmp, buffer + offset, length);
str = (char*) (buffer + offset);
tmp[length] = 0;
for (i = 0; i < length; i++)
{
if (str[i] >= 32 && str[i] <= 126)
{
printf("%c",str[i]);
}
else
{
printf("\\x%02x", str[i]);
}
if (unicode) i++;
}
printf("\n");
}
void print_hex_string(unsigned char* buffer, unsigned int buffer_size, unsigned int offset, unsigned int length)
{
int i;
char* str;
printf("%s\n", tmp);
free(tmp);
str = (char*) (buffer + offset);
for (i = 0; i < length; i++)
{
printf("%02X ", str[i]);
}
printf("\n");
}
int callback(RULE* rule, unsigned char* buffer, unsigned int buffer_size, void* data)
@@ -184,6 +208,8 @@ int callback(RULE* rule, unsigned char* buffer, unsigned int buffer_size, void*
STRING* string;
MATCH* match;
int rule_match;
int string_found;
int show = TRUE;
if (show_specified_tags)
@@ -203,6 +229,10 @@ int callback(RULE* rule, unsigned char* buffer, unsigned int buffer_size, void*
}
}
rule_match = (rule->flags & RULE_FLAGS_MATCH);
show = show && ((!negate && rule_match) || (negate && !rule_match));
if (show)
{
if (show_tags)
@@ -240,13 +270,17 @@ int callback(RULE* rule, unsigned char* buffer, unsigned int buffer_size, void*
printf("%s %s\n", rule->identifier, (char*) data);
}
/* show matched strings */
if (show_strings)
{
string = rule->string_list_head;
while (string != NULL)
{
if (string->flags & STRING_FLAGS_FOUND)
string_found = string->flags & STRING_FLAGS_FOUND;
if ( (!string_found))
{
match = string->matches;
@@ -256,17 +290,15 @@ int callback(RULE* rule, unsigned char* buffer, unsigned int buffer_size, void*
if (IS_HEX(string))
{
//TODO: print_hex_string()
printf("\n");
print_hex_string(buffer, buffer_size, match->offset, match->length);
}
else if (IS_WIDE(string))
{
//TODO: print_wide_string()
printf("\n");
print_string(buffer, buffer_size, match->offset, match->length, TRUE);
}
else
{
print_string(buffer, buffer_size, match->offset, match->length);
print_string(buffer, buffer_size, match->offset, match->length, FALSE);
}
match = match->next;
@@ -287,7 +319,7 @@ int process_cmd_line(int argc, char const* argv[])
TAG* tag;
opterr = 0;
while ((c = getopt (argc, (char**) argv, "rsvgt:")) != -1)
while ((c = getopt (argc, (char**) argv, "rnsvgt:")) != -1)
{
switch (c)
{
@@ -306,6 +338,10 @@ int process_cmd_line(int argc, char const* argv[])
case 's':
show_strings = TRUE;
break;
case 'n':
negate = TRUE;
break;
case 't':