VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
7.95k stars 1.42k forks source link

console.log no output #1997

Closed PanosKwork closed 8 months ago

PanosKwork commented 8 months ago
import "elf"
import "console"

rule test
{
    condition:
        (
            for any i in (0..elf.number_of_sections):
            (
        console.log(elf.sections[i].name) // output none
                // elf.sections[i].name == ".app.version" and console.log(elf.sections[i].name)  //output ".app.version"
            )
        )
}

os:linux yara:4.2.3,4.4.0 sample:d4645d2c29505cf10d1b201826c777b62cbf9d752cb1008bef1192e0dd545a82 test

PanosKwork commented 8 months ago
import "elf"
import "console"

rule test
{
    condition:
        (
            for any i in (0..elf.number_of_sections):
            (
        console.log(elf.sections[i].name) and false
            )
        )
}

output

.interp
.note.ABI-tag
.note.gnu.build-id
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rela.dyn
.rela.plt
.init
.plt
.text
.fini
.rodata
.app.version
.cfgETD
.eh_frame_hdr
.eh_frame
.gcc_except_table
.tbss
.init_array
.fini_array
.jcr
.data.rel.ro
.dynamic
.got
.data
nocommon
.bss
.comment
.shstrtab