VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
8.08k stars 1.43k forks source link

Allow unreferenced strings if they start with '_' #1941

Closed wxsBSD closed 1 year ago

wxsBSD commented 1 year ago

As briefly discussed in #1937, this change will make it so that any string identifier that starts with '_' can be unreferenced. Any anonymous strings must still be referenced.

While testing this out I realized that an unreferenced string still had the STRING_FLAG_FIXED_OFFSET set, which meant any unreferenced string would have a fixed_offset of YR_UNDEFINED. To deal with this when we are reducing the rule we unset STRING_FLAG_FIXED_OFFSET if the string is unreferenced.