mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-11 22:49:58 +00:00
30 lines
713 B
Plaintext
30 lines
713 B
Plaintext
/L20"YARA rules" YARA_LANG Line Comment = // Block Comment On = /* Block Comment Off = */ Escape Char = \ String Chars = " File Extensions = YAR
|
|
/Marker Characters = "//"
|
|
/Delimiters = ~!@%^&*()-+=|\/{}[]<>:;"' , .?
|
|
/Function String = "rule [a-zA-Z0-9_]*"
|
|
/Indent Strings = "{"
|
|
/Unindent Strings = "}"
|
|
/Open Brace Strings = "{" "(" "["
|
|
/Close Brace Strings = "}" ")" "]"
|
|
|
|
/C1"YARA Keywords"
|
|
and at any all ascii
|
|
condition contains
|
|
endswith entrypoint
|
|
for false filesize fullword
|
|
global
|
|
icontains iendswith is istartswith in include int8 int16 int32
|
|
meta matches
|
|
nocase not
|
|
or of
|
|
private
|
|
rule rva
|
|
section startswith strings
|
|
them true
|
|
uint8 uint16 uint32
|
|
wide
|
|
|
|
/C4"YARA Strings"
|
|
"
|
|
// /
|