New xor modifier causes parsing failure about plyara HOT 6 CLOSED

Thanks for the report! We'll get an update for this and any other changes with recent YARA versions shortly.

from plyara.

I'm not sure of an easy change to support this new format for xor string operator. This change requires rewriting how string operators are parsed.

from plyara.

I am not an expert in lexers and parsers, so this may be wrong, but give this a try: malwarefrank@42a9ead

If that works, then I can create a test and submit a PR

from plyara.

I took what @malwarefrank had, and added more to it.
malvidin@0fcf46b

All of the following are all legitimate XOR modifiers. The first is already handled, and the second one appears to be handled by @malwarefrank's modification.

xor
xor(0x01-0xFA)

xor(0x01)
xor(1)
xor(1-250)
xor(000001-00000250)
xor(0x01-00000250)
xor(000001-0xFF)

This requires all of the following, unless the xor_mod is created as a new token. I didn't see a way to create a single byte hex/int token that didn't cause extraction issues with the NUM and HEXNUM tokens.

                           | XOR_MOD LPAREN NUM RPAREN
                           | XOR_MOD LPAREN NUM HYPHEN NUM RPAREN
                           | XOR_MOD LPAREN HEXNUM RPAREN
                           | XOR_MOD LPAREN HEXNUM HYPHEN HEXNUM RPAREN
                           | XOR_MOD LPAREN NUM HYPHEN HEXNUM RPAREN
                           | XOR_MOD LPAREN HEXNUM HYPHEN NUM RPAREN

I recommend adding a way to determine which version of YARA that plyara can parse, so that accepting the modified XOR won't impact use with versions before YARA 3.11.0.

I did not add anything yet to rebuild_yara_rule to recreate string modifiers with parameters, or checks for YARA >= 3.11.0 version compatibility.

from plyara.

I've made additional modifications here malvidin@35b9b5d
, but there are still enhancements that could be made.

@malwarefrank, does my current commit meet your current needs?

• Recommend imports being made before use
• Ensure all named and anonymous strings are referenced
• Parse conditions in a way that ensures logical validity
• Version compatibility checks for conditions & iteration

The reason I brought back the rebuild_yara_rule utility is due to the use by CCCS-Yara
https://github.com/CybercentreCanada/CCCS-Yara/blob/master/yara-validator/yara_validator.py#L414

from plyara.

Hi,

I'd just like to add a ++ for considerations on rebuild_yara_rule i think most plyara users will want to rebuild a rule from the parsed rule (otherwise why not just check it compiles with yara itself?).

Thanks,
Tom

from plyara.