mquery icon indicating copy to clipboard operation
mquery copied to clipboard

Improve parsing of string count expressions

Open msm-code opened this issue 3 years ago • 0 comments

Your checklist for this pull request

  • [x] I've read the contributing guideline.
  • [x] I've tested my changes by building and running mquery, and testing changed functionality (if applicable)
  • [x] I've added automated tests for my change (if applicable, optional)
  • [ ] I've updated documentation to reflect my change (if applicable)

What is the current behaviour?

The bug was discovered by running something equivalent to:

rule rule_name
{
    meta:
        description = "description"
        author = "author"
        date = "2022-04-05"
        reference = "reference"
        hash = "hash"
    strings:
        $name = "string"
    condition:
        #name >=3
}

>= operator was not supported well enough. I've also found many other cases of similar problems.

What is the new behaviour?

I fix some of the problems. There are still many ways to improve this (for example, handle #x != 0)

Test plan

I've tried to avoid any bugs, but due to the nature of the code (explicitly checking types of operators and parameters) it's bug-prone and there may be obscure combinations of operators that will be broken by this. I've taken moderate care to avoid this, but consulting https://yara.readthedocs.io/en/stable/writingrules.html for any edge cases may be helpful in review.

Closing issues

Submitted privately, no github issue.

msm-code avatar Apr 10 '22 14:04 msm-code