mquery
mquery copied to clipboard
Add the information about match context to the database
To implement #38, we'll need to add the information about match context to the database. AFAIK it's not possible to get it directly from Yara-Python (but do check), so it must be worked around by using offset: https://github.com/VirusTotal/yara/issues/1335
This information should be stored for every string in every matched rule (there may be more than one rule). So maybe matches array should be changed to a dict. We can just store hexencoded context in the matches field then (as long as it's not too big).
for example if the rule is
rule test_romanum {
strings:
$a = "a"
$b = "b"
condition:
all of them
}
rule test_romanum {
strings:
$c = "c"
$d = "d"
condition:
all of them
}
There may be as much as 4 matches. If there are more than one match per string then only the first should be stored, and the rest ignored.
Finally, this information should be exposed via the API (included in the serialized object) like /api/job/{job_id}.