This is a combination of "OP_OF" and "OP_FOUND_IN" that allows you to express logic like "all of them in (0..100)". This came out of the discussion in #1483 and likely makes part of that pull request redundant.
I fixed syntax of table in writingrules.rst
・“YARA keywords” table has syntax error, and it table couldn't see on the document page.
・I changed that some '*' positions.
* pe: add signature[i].algorithm_oid
Certificate signature algorithms are encoded using object identifiers
whose text representations depend on the cryptographic library. For
stable YARA rules, it is wiser to rely on the OID, so let's provide
it.
For example, while OpenSSL 1.1.1d resolves 1.2.840.113549.1.1.11 to
"sha256WithRSAEncryption" (or "RSA-SHA256" for the short name), the
only string representation I have gotten out of the Windows CryptoAPI
is "sha256RSA".
* Add documentation for signature[i].algorithm_oid
With this change the yr_scanner_scan_mem_blocks function can return ERROR_BLOCK_NOT_READY when the YR_MEMORY_BLOCK_ITERATOR that provides memory blocks to the function is not ready to return the next block. After this error the caller can retry the call to yr_scanner_scan_mem_blocks multiple times until the function succeeds or fails with some other error code.
Co-authored-by: Simon Hardy-Francis <[email protected]>
When we hit the maximum match limit on a string we currently abort all scanning,
which can be problematic since it isn't a good reason to stop all scanning, and
is better off as a warning to the user.
This commit makes it so that when the string match limit is hit a warning is
printed and scanning will continue. The warning message indicates that the
results may be invalid. It is hard to know for certain if they are invalid
because it depends entirely upon the condition. If you use the # or @ operator
then your condition _MAY_ be invalid since the total number of matches and
locations is not known anymore. Just checking that the string exists won't be an
invalid state since we have confirmed the existence of _AT LEAST_ the maximum
number of occurrences, which clearly satisfies the existence of a single
instance of your string.
I decided to implement this as a callback so the user of libyara has some choice
on the default behavior. If they want to consider this a "stop all scanning"
error they are free to return CALLBACK_ERROR in their callback.
* Implement pe.entry_point_raw.
Add pe.entry_point_raw which is the raw value of the entry point field from the
optional header. This value is NOT converted to a file offset or a virtual
address, and is just the raw bytes taken straight from the header.
This allows you to use the entry point as it is specified in the file without
having to jump through hoops to parse it by hand in your condition.
* Specify the version in which entry_point_raw was added.
Co-authored-by: Victor M. Alvarez <[email protected]>
