search

Northern-Lights / yara-parser

Tools for parsing rulesets using the exact grammar as YARA. Written in Go.
MIT License
82 stars 9 forks source link

Parentheses alone on a line not working #3

Closed Northern-Lights closed 6 years ago

Northern-Lights commented 6 years ago

Despite using YARA's grammar.y file, the parser is failing to recognize rules such as the following:

rule FOR {
strings:
    $s1 = "abc"
condition:
    (for any i in (0..#s1) : (
        @s1[i] > 5
    ))
}
$ y2j for.yar 
Couldn't parse YARA ruleset: Parser result: "1" grammar: lexical error @5: "syntax error: unexpected _DOT_DOT_, expecting _RPAREN_ or _OR_ or _AND_"
Northern-Lights commented 6 years ago

integer_set was accidentally deleted when the rules were being hollowed out