Before this change if the identifier $a was used in 100 rules, the text string "$a" would appear 100 times in the compiled rules. After this change it is saved once and referenced from multiple places. The same happens with module names, literal strings used in the rules and so on.
This introduces a change in the way in which "for-in" loops work by introducing the concept of iterators. These kind of loops now accept an iterator that will return a sequence of values. Besides the integer ranges (N..M) and integer enumerations (X,Y,Z), this kind of loops now accepts other kinds of iterables, like arrays. This allows conditions like the following one:
for any section in pe.sections: ( section.name == "foo" )
Until now the same expression was written as:
for any i in (0..pe.number_of_sections - 1): ( pe.sections[i].name == "foo" )
The new syntax is more legible and opens door for more powerful features in the future. Backward compatibility is maintained.
* Implement improved xor modifier.
* Fix breakage when xor(...) came before another modifier.
* Add documentation for xor improvements.
* Fixes from review by Victor.
- No more changes to lexer.
- Duplicate modifiers are now errors.
- Do not rely on undocumented behavior in bison.
* Apply fix to deal with undocumented bison feature we shouldn't rely on.
* Make xor work properly with other modifiers.
This commit now makes it so that "xor(1-255) wide" will no longer search for the
plaintext wide version of the string, but "xor wide" will because it implies
xor(0-255).
* Add support for xor(X) and tests.
* Fixes for xor modifier.
This commit makes the xor modifier no longer include "plaintext" versions of the
strings. In particular if you have:
$a = "This program cannot" xor
Then it will no longer match on the plaintext version of the string. It will
only match on the xor versions. If you want it to match on plaintext or xor then
you can use:
$a = "This program cannot" xor ascii
The same is true for wide.
* Make 'xor nocase' a compiler error.
* Add newline between ascii and wide strings.
Returning ERROR_INVALID_ARGUMENT from yr_ac_automaton_destroy is ok, but then we should do the same for all yr_ac_xxx functions for maintaining API coherence. Let's stick to the policy of expecting a non-null automaton in all yr_ac_xxx functions and fix the problem at its root.
Also makes sure that external variables defined with yr_compile_define_xxx_variable retain their values when rules are saved and loaded again from disk.
* Unify compiler's last_result and last_error fields into a single last_error field.
* Rename RE_LEX_ENVIRONMENT's last_error_code to last_error, for coherency with YR_COMPILER.
Victor M. Alvarez