mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-12 02:10:00 +00:00
Add docs for unreferenced strings. (#1958)
* Add docs for unreferenced strings. * Add example for unreferenced string.
This commit is contained in:
@@ -738,6 +738,26 @@ the C API.
|
||||
$text_string
|
||||
}
|
||||
|
||||
Unreferenced strings
|
||||
--------------------
|
||||
|
||||
YARA 4.4.0 allows for unreferenced strings in the condition. If a string
|
||||
identifier starts with an ``_`` then it does not have to be referenced in the
|
||||
condition. Any other string must be referenced in the condition. This is useful
|
||||
if you want to search for particular strings and handle them in a custom
|
||||
callback but don't really need them for your condition logic.
|
||||
|
||||
.. code-block:: yara
|
||||
|
||||
rule PrivateStringExample
|
||||
{
|
||||
strings:
|
||||
$_unreferenced = "AXSERS"
|
||||
|
||||
condition:
|
||||
true
|
||||
}
|
||||
|
||||
String Modifier Summary
|
||||
-----------------------
|
||||
|
||||
|
||||
Reference in New Issue
Block a user