mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-12 02:10:00 +00:00
Implement "none" keyword (#1559)
Co-authored-by: Victor M. Alvarez <[email protected]>
This commit is contained in:
Wesley Shields
co-authored by
Victor M. Alvarez
Victor M. Alvarez
parent
eadd85643b
commit
eb92e6b5aa
@@ -57,24 +57,24 @@ keywords are reserved and cannot be used as an identifier:
|
||||
- matches
|
||||
- meta
|
||||
- nocase
|
||||
* - not
|
||||
* - none
|
||||
- not
|
||||
- of
|
||||
- or
|
||||
- private
|
||||
- rule
|
||||
- startswith
|
||||
- strings
|
||||
- them
|
||||
* - true
|
||||
* - them
|
||||
- true
|
||||
- uint16
|
||||
- uint16be
|
||||
- uint32
|
||||
- uint32be
|
||||
- uint8
|
||||
- uint8be
|
||||
- wide
|
||||
* - xor
|
||||
-
|
||||
* - wide
|
||||
- xor
|
||||
-
|
||||
-
|
||||
-
|
||||
@@ -1156,7 +1156,7 @@ the equivalent keyword ``them`` for more legibility.
|
||||
|
||||
In all the examples above, the number of strings have been specified by a
|
||||
numeric constant, but any expression returning a numeric value can be used.
|
||||
The keywords ``any`` and ``all`` can be used as well.
|
||||
The keywords ``any``, ``all`` and ``none`` can be used as well.
|
||||
|
||||
.. code-block:: yara
|
||||
|
||||
@@ -1165,6 +1165,7 @@ The keywords ``any`` and ``all`` can be used as well.
|
||||
all of ($a*) // all strings whose identifier starts by $a
|
||||
any of ($a,$b,$c) // any of $a, $b or $c
|
||||
1 of ($*) // same that "any of them"
|
||||
none of ($b*) // zero of the set of strings that start with "$b"
|
||||
|
||||
|
||||
Starting with YARA 4.2.0 it is possible to express a set of strings in an
|
||||
|
||||
+791
-774
File diff suppressed because it is too large
Load Diff
+58
-56
@@ -86,33 +86,34 @@ extern int yara_yydebug;
|
||||
_ENTRYPOINT_ = 287, /* "<entrypoint>" */
|
||||
_ALL_ = 288, /* "<all>" */
|
||||
_ANY_ = 289, /* "<any>" */
|
||||
_IN_ = 290, /* "<in>" */
|
||||
_OF_ = 291, /* "<of>" */
|
||||
_FOR_ = 292, /* "<for>" */
|
||||
_THEM_ = 293, /* "<them>" */
|
||||
_MATCHES_ = 294, /* "<matches>" */
|
||||
_CONTAINS_ = 295, /* "<contains>" */
|
||||
_STARTSWITH_ = 296, /* "<startswith>" */
|
||||
_ENDSWITH_ = 297, /* "<endswith>" */
|
||||
_ICONTAINS_ = 298, /* "<icontains>" */
|
||||
_ISTARTSWITH_ = 299, /* "<istartswith>" */
|
||||
_IENDSWITH_ = 300, /* "<iendswith>" */
|
||||
_IEQUALS_ = 301, /* "<iequals>" */
|
||||
_IMPORT_ = 302, /* "<import>" */
|
||||
_TRUE_ = 303, /* "<true>" */
|
||||
_FALSE_ = 304, /* "<false>" */
|
||||
_OR_ = 305, /* "<or>" */
|
||||
_AND_ = 306, /* "<and>" */
|
||||
_NOT_ = 307, /* "<not>" */
|
||||
_EQ_ = 308, /* "==" */
|
||||
_NEQ_ = 309, /* "!=" */
|
||||
_LT_ = 310, /* "<" */
|
||||
_LE_ = 311, /* "<=" */
|
||||
_GT_ = 312, /* ">" */
|
||||
_GE_ = 313, /* ">=" */
|
||||
_SHIFT_LEFT_ = 314, /* "<<" */
|
||||
_SHIFT_RIGHT_ = 315, /* ">>" */
|
||||
UNARY_MINUS = 316 /* UNARY_MINUS */
|
||||
_NONE_ = 290, /* "<none>" */
|
||||
_IN_ = 291, /* "<in>" */
|
||||
_OF_ = 292, /* "<of>" */
|
||||
_FOR_ = 293, /* "<for>" */
|
||||
_THEM_ = 294, /* "<them>" */
|
||||
_MATCHES_ = 295, /* "<matches>" */
|
||||
_CONTAINS_ = 296, /* "<contains>" */
|
||||
_STARTSWITH_ = 297, /* "<startswith>" */
|
||||
_ENDSWITH_ = 298, /* "<endswith>" */
|
||||
_ICONTAINS_ = 299, /* "<icontains>" */
|
||||
_ISTARTSWITH_ = 300, /* "<istartswith>" */
|
||||
_IENDSWITH_ = 301, /* "<iendswith>" */
|
||||
_IEQUALS_ = 302, /* "<iequals>" */
|
||||
_IMPORT_ = 303, /* "<import>" */
|
||||
_TRUE_ = 304, /* "<true>" */
|
||||
_FALSE_ = 305, /* "<false>" */
|
||||
_OR_ = 306, /* "<or>" */
|
||||
_AND_ = 307, /* "<and>" */
|
||||
_NOT_ = 308, /* "<not>" */
|
||||
_EQ_ = 309, /* "==" */
|
||||
_NEQ_ = 310, /* "!=" */
|
||||
_LT_ = 311, /* "<" */
|
||||
_LE_ = 312, /* "<=" */
|
||||
_GT_ = 313, /* ">" */
|
||||
_GE_ = 314, /* ">=" */
|
||||
_SHIFT_LEFT_ = 315, /* "<<" */
|
||||
_SHIFT_RIGHT_ = 316, /* ">>" */
|
||||
UNARY_MINUS = 317 /* UNARY_MINUS */
|
||||
};
|
||||
typedef enum yytokentype yytoken_kind_t;
|
||||
#endif
|
||||
@@ -153,39 +154,40 @@ extern int yara_yydebug;
|
||||
#define _ENTRYPOINT_ 287
|
||||
#define _ALL_ 288
|
||||
#define _ANY_ 289
|
||||
#define _IN_ 290
|
||||
#define _OF_ 291
|
||||
#define _FOR_ 292
|
||||
#define _THEM_ 293
|
||||
#define _MATCHES_ 294
|
||||
#define _CONTAINS_ 295
|
||||
#define _STARTSWITH_ 296
|
||||
#define _ENDSWITH_ 297
|
||||
#define _ICONTAINS_ 298
|
||||
#define _ISTARTSWITH_ 299
|
||||
#define _IENDSWITH_ 300
|
||||
#define _IEQUALS_ 301
|
||||
#define _IMPORT_ 302
|
||||
#define _TRUE_ 303
|
||||
#define _FALSE_ 304
|
||||
#define _OR_ 305
|
||||
#define _AND_ 306
|
||||
#define _NOT_ 307
|
||||
#define _EQ_ 308
|
||||
#define _NEQ_ 309
|
||||
#define _LT_ 310
|
||||
#define _LE_ 311
|
||||
#define _GT_ 312
|
||||
#define _GE_ 313
|
||||
#define _SHIFT_LEFT_ 314
|
||||
#define _SHIFT_RIGHT_ 315
|
||||
#define UNARY_MINUS 316
|
||||
#define _NONE_ 290
|
||||
#define _IN_ 291
|
||||
#define _OF_ 292
|
||||
#define _FOR_ 293
|
||||
#define _THEM_ 294
|
||||
#define _MATCHES_ 295
|
||||
#define _CONTAINS_ 296
|
||||
#define _STARTSWITH_ 297
|
||||
#define _ENDSWITH_ 298
|
||||
#define _ICONTAINS_ 299
|
||||
#define _ISTARTSWITH_ 300
|
||||
#define _IENDSWITH_ 301
|
||||
#define _IEQUALS_ 302
|
||||
#define _IMPORT_ 303
|
||||
#define _TRUE_ 304
|
||||
#define _FALSE_ 305
|
||||
#define _OR_ 306
|
||||
#define _AND_ 307
|
||||
#define _NOT_ 308
|
||||
#define _EQ_ 309
|
||||
#define _NEQ_ 310
|
||||
#define _LT_ 311
|
||||
#define _LE_ 312
|
||||
#define _GT_ 313
|
||||
#define _GE_ 314
|
||||
#define _SHIFT_LEFT_ 315
|
||||
#define _SHIFT_RIGHT_ 316
|
||||
#define UNARY_MINUS 317
|
||||
|
||||
/* Value type. */
|
||||
#if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
|
||||
union YYSTYPE
|
||||
{
|
||||
#line 304 "grammar.y"
|
||||
#line 306 "grammar.y"
|
||||
|
||||
YR_EXPRESSION expression;
|
||||
SIZED_STRING* sized_string;
|
||||
@@ -199,7 +201,7 @@ union YYSTYPE
|
||||
YR_ARENA_REF meta;
|
||||
YR_ARENA_REF string;
|
||||
|
||||
#line 203 "grammar.h"
|
||||
#line 205 "grammar.h"
|
||||
|
||||
};
|
||||
typedef union YYSTYPE YYSTYPE;
|
||||
|
||||
+9
-2
@@ -60,8 +60,9 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
#define YYMALLOC yr_malloc
|
||||
#define YYFREE yr_free
|
||||
|
||||
#define FOR_EXPRESSION_ALL 1
|
||||
#define FOR_EXPRESSION_ANY 2
|
||||
#define FOR_EXPRESSION_ALL 1
|
||||
#define FOR_EXPRESSION_ANY 2
|
||||
#define FOR_EXPRESSION_NONE 3
|
||||
|
||||
#define fail_with_error(e) \
|
||||
{ \
|
||||
@@ -193,6 +194,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
%token _ENTRYPOINT_ "<entrypoint>"
|
||||
%token _ALL_ "<all>"
|
||||
%token _ANY_ "<any>"
|
||||
%token _NONE_ "<none>"
|
||||
%token _IN_ "<in>"
|
||||
%token _OF_ "<of>"
|
||||
%token _FOR_ "<for>"
|
||||
@@ -2238,6 +2240,11 @@ for_expression
|
||||
yr_parser_emit_push_const(yyscanner, 1);
|
||||
$$ = FOR_EXPRESSION_ANY;
|
||||
}
|
||||
| _NONE_
|
||||
{
|
||||
yr_parser_emit_push_const(yyscanner, 0);
|
||||
$$ = FOR_EXPRESSION_NONE;
|
||||
}
|
||||
;
|
||||
|
||||
|
||||
|
||||
+335
-330
File diff suppressed because it is too large
Load Diff
@@ -196,6 +196,7 @@ octdigit [0-7]
|
||||
"for" { return _FOR_; }
|
||||
"all" { return _ALL_; }
|
||||
"any" { return _ANY_; }
|
||||
"none" { return _NONE_; }
|
||||
"entrypoint" { return _ENTRYPOINT_; }
|
||||
"filesize" { return _FILESIZE_; }
|
||||
"matches" { return _MATCHES_; }
|
||||
|
||||
@@ -1533,6 +1533,11 @@ static void test_of()
|
||||
"condition: any of them }",
|
||||
TEXT_1024_BYTES "mississippi");
|
||||
|
||||
assert_true_rule(
|
||||
"rule test { strings: $a = \"ssi\" $b = \"mis\" $c = \"oops\" "
|
||||
"condition: none of them }",
|
||||
TEXT_1024_BYTES "AXSERS");
|
||||
|
||||
assert_true_rule(
|
||||
"rule test { strings: $a = \"ssi\" $b = \"mis\" private $c = \"oops\" "
|
||||
"condition: 1 of them }",
|
||||
@@ -1548,6 +1553,11 @@ static void test_of()
|
||||
"condition: any of ($a*, $b*) }",
|
||||
TEXT_1024_BYTES "mississippi");
|
||||
|
||||
assert_true_rule(
|
||||
"rule test { strings: $a1 = \"dummy1\" $b1 = \"dummy1\" $b2 = \"ssi\""
|
||||
"condition: none of ($a*, $b*) }",
|
||||
TEXT_1024_BYTES "AXSERS");
|
||||
|
||||
assert_true_rule_blob(
|
||||
"rule test { \
|
||||
strings: \
|
||||
|
||||
Reference in New Issue
Block a user