mirror of
https://github.com/VirusTotal/yara.git
synced 2026-10-12 02:10:00 +00:00
Wesley Shields
723e3c2114
Add a console module which can be used to print things during condition
execution. This is especially useful for debugging complex conditions where
you're following multiple offsets. For example, people sometimes want to express
a PE by doing this:
uint32(uint32(0x3c)) == 0x50450000
What they really want is:
uint32be(uint32(0x3c)) == 0x50450000
Or they want:
uint32(uint32(0x3c)) == 0x00004550
In either case it would be helpful if they could do:
console.hex(uint32(uint32(0x3c)))
Another example of where this could be useful is being able to know what YARA
thinks an imphash is just by doing:
console.log(pe.imphash())
* Make console module a default module.
* Add support for optional string messages.
Override each function so that it can also take an optional string that is
printed at the start of the message. Tested with the following:
import "pe"
import "math"
import "console"
rule a {
condition:
console.hex("0x3c: ", uint32(uint32(0x3c))) and
console.hex(uint32(uint32(0x3c))) and
console.log("String: ", "foo\x00bar\x01baz") and
console.log("foo\x00bar\x01baz") and
console.log("Some integer: ", 987654321) and
console.log(987654321) and
console.log("Some float: ", math.MEAN_BYTES) and
console.log(math.MEAN_BYTES) and
console.log("Imphash: ", pe.imphash()) and
console.log(pe.imphash())
}
* Remove duplicate macro definitions.
* Make console functions use callback.
Add a CALLBACK_MSG_CONSOLE_LOG which the console module uses to send a message
to the main callback. Make the console module functions all generate a single
string which is then passed to the callback. This keeps the callback handler
simple: it just prints a string.
* Fix newlines.
* Add docs for console functionality.
* Add docs for console_callback to yara-python.
* Address comments from Victor.