This fixes two issues:
1. asprintf is a GNU extension and it's not available in all compilers, specifically Microsoft Visual Studio.
2. asprintf allocates memory using malloc, but the console module frees the memory using yr_free, this works fine in those platforms in which yr_malloc/yr_free is a direct call to malloc/free, but it won't work in Windows where yr_malloc/yr_free are calls to HeapAlloc/HeapFree with a dedicated heap.
Add a console module which can be used to print things during condition
execution. This is especially useful for debugging complex conditions where
you're following multiple offsets. For example, people sometimes want to express
a PE by doing this:
uint32(uint32(0x3c)) == 0x50450000
What they really want is:
uint32be(uint32(0x3c)) == 0x50450000
Or they want:
uint32(uint32(0x3c)) == 0x00004550
In either case it would be helpful if they could do:
console.hex(uint32(uint32(0x3c)))
Another example of where this could be useful is being able to know what YARA
thinks an imphash is just by doing:
console.log(pe.imphash())
* Make console module a default module.
* Add support for optional string messages.
Override each function so that it can also take an optional string that is
printed at the start of the message. Tested with the following:
import "pe"
import "math"
import "console"
rule a {
condition:
console.hex("0x3c: ", uint32(uint32(0x3c))) and
console.hex(uint32(uint32(0x3c))) and
console.log("String: ", "foo\x00bar\x01baz") and
console.log("foo\x00bar\x01baz") and
console.log("Some integer: ", 987654321) and
console.log(987654321) and
console.log("Some float: ", math.MEAN_BYTES) and
console.log(math.MEAN_BYTES) and
console.log("Imphash: ", pe.imphash()) and
console.log(pe.imphash())
}
* Remove duplicate macro definitions.
* Make console functions use callback.
Add a CALLBACK_MSG_CONSOLE_LOG which the console module uses to send a message
to the main callback. Make the console module functions all generate a single
string which is then passed to the callback. This keeps the callback handler
simple: it just prints a string.
* Fix newlines.
* Add docs for console functionality.
* Add docs for console_callback to yara-python.
* Address comments from Victor.
Hilko Bengen