Comments (3)
From [email protected] on May 31, 2012 18:43:47
Out of curiosity, I decided to test this just now with Yara v1.6
(Disclaimer: I have nothing to do with Yara, I'm just a regular user.)
I don't really understand what this bug report is saying, but here are my observations about " at ":
2 of ($foo*) will...
... always be false if you only have one "$foo1" defined in the strings section.
... be true if you repeat your string twice, even if your input only has a single occurrence. So,
$foo1="foo"
$foo2="foo"
2 of ($foo*)
will always be true if your input file contains a single "foo" string. In general, I don't think anyone is ever going to be writing rules like this.
... work correctly if you have three strings defined, and any two of them appear at least once, for each string. So,
$foo1="foo"
$foo2="bar"
$foo3="buz"
2 of ($foo*)
will match "foobar", but not match "foofoo" or "barbar" Is this the issue?
from yara.
From [email protected] on August 15, 2012 09:02:30
During a brief period of time a buggy version 1.5 having this problem was available to download. The issue was solved short after that this shouldn't be a problem with more recent versions.
Status: Done
from yara.
From [email protected] on August 15, 2012 09:02:32
During a brief period of time a buggy version 1.5 having this problem was available to download. The issue was solved short after that this shouldn't be a problem with more recent versions.
from yara.
Related Issues (20)
- another example: I want to scan Chinese character by regex yara rules as beloww:
- YARA keeps deleting this file and making everyone's life harder HOT 1
- Assert in isprint the debug version of YARA (
- Support for EXTERNAL OBJECT_TYPE_ARRAY and OBJECT_TYPE_STRUCTURE HOT 1
- ImportError on Ubuntu 18.04 and CentOS 7 HOT 1
- Improve Tlsh library in Yara
- string memory of yara cli not correctly freed
- About release 4.4.0 HOT 3
- the computation of imphash in pe module HOT 1
- Syntax improvement for count of string set HOT 1
- Implicit widening of multiplication result can cause unintended overflow
- Avoid rand() and std::rand() for generating pseudorandom numbers HOT 1
- Missing error handling while converting a string to a number, using C stdlib functions HOT 1
- imphash edge case HOT 3
- yara regex scan, match some invisible characters HOT 1
- Get help with cuckoo module HOT 1
- Get help with cuckoo module HOT 2
- calloc behavior on AIX platform HOT 4
- Cannot function properly under the mounted path in VMware linux virtual machine.
- .yar is correct but .yc error: non-ascii character
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from yara.