search

VirusTotal / yara-x

A rewrite of YARA in Rust.
https://virustotal.github.io/yara-x/
BSD 3-Clause "New" or "Revised" License
565 stars 46 forks source link

Expanding support for global variable objects. #114

Open msuiche opened 1 month ago

msuiche commented 1 month ago

This is something which was lacking in the C version, according to the current documentation yara-x only supports "global external variable" but not "external object" which would include arrays and structures for richer data enrichment.

This could be really great for modules that would want to keep the same name convention of VirusTotal live hunting to make rules interoperable for example variables like vt.behaviour.command_executions or vt.behaviour.modules_loaded which are only accessible as an array via the for loop keyword. But also variables under specific structures such as vt.behaviour.

More information about existing issues which were not addressable in the current C version of yara: Support for EXTERNAL OBJECT_TYPE_ARRAY and OBJECT_TYPE_STRUCTURE Exporting yr_object_create() to enable custom structures?

plusvic commented 1 month ago

This is something that I have in mind for future releases. I'm currently focused in releasing a version that has feature parity with yara, but more advanced features like this are in the plan.

msuiche commented 1 month ago

Excellent! Amazing job as usual @plusvic !