gyp
gyp copied to clipboard
Does not support xor() in strings
I am not sure if this is valid Yara but I have a lot of rules that make use of this constuct
rule X {
strings:
$A = "hello" xor(0x01-0xff)
condition:
any of them
}
This fails to parse properly:
$ ./y2j /tmp/1.yar
Couldn't parse YARA ruleset: line 3: syntax error: unexpected _HEX_NUMBER_, expecting _NUMBER_