gaohang

Compared with hashmap, DAT consumes less memory. However, hashmap of 100000000 docs can be build in memory, while DAT with 10000000 docs leads to OOM?

why version strings are in xref basic block? > FACT uses mostly YARA to directly match the version. Some programs store the version in a separate string and use string...

> Yara does not have unicode handling in strings, and the `\u` syntax does not exist. What you wrote is actually `[u8fd9]`, so one of those five ascii bytes. >...