yara_tools icon indicating copy to clipboard operation
yara_tools copied to clipboard

Unexpected Behavior With IDENTIFIER Template

Open matonis opened this issue 6 years ago • 0 comments

rule.add_strings(strings="HelloWorld",condition="$IDENTIFIER at 0")

This possibly relates to enhancing condition functionality, but the template for conditions has no idea to map integers assigned to unitialized string variables. Meaning, the template cannot identifiy which incremental integer is represented in the rule.

This bug might be the start of an entire rewrite of relating strings & conditions in an entirely separate object. Not entirely sure yet if this is a bug based on how many might be actually using YARA.

matonis avatar Dec 31 '18 03:12 matonis