gyp icon indicating copy to clipboard operation
gyp copied to clipboard

Does not support xor() in strings

Open scudette opened this issue 1 year ago • 0 comments

I am not sure if this is valid Yara but I have a lot of rules that make use of this constuct

rule X {
  strings:
    $A = "hello" xor(0x01-0xff)

  condition:
    any of them
}

This fails to parse properly:

$ ./y2j /tmp/1.yar
Couldn't parse YARA ruleset: line 3: syntax error: unexpected _HEX_NUMBER_, expecting _NUMBER_

scudette avatar Feb 07 '25 21:02 scudette