yara
yara copied to clipboard
Max String Modifier
I've a case where I only want to find the first instance of $ however, when $ is { 00 } it will have too many hits and slow down scanning. Is there something like a modifier that would limit the number of matches found when parsing the file - thinking something like:
rule test{
string:
$null = { 00 } max(1)
condition:
.
.
}
Thus I can still use @test as an anchor AND keep YARA happy