avast / yaramod

Parsing of YARA rules into AST and building new rulesets in C++.
MIT License
120 stars 44 forks source link

All Expressions setters need to modify its TokenStream appropriately #108

Open TadeasKucera opened 4 years ago

TadeasKucera commented 4 years ago

We need to design a proper way of exchanging Tokens of expressions that come as parameters for setter methods of expression classes.

StringAtExpression::setAtExpression(...)
StringInRangeExpression::setRangeExpression(...)
StringOffsetExpression::setIndexExpression(...)
StringLengthExpression::setIndexExpression(...)
UnaryOpExpression::setOperand(...)
BinaryOpExpression::setLeftOperand(...)
BinaryOpExpression::setRightOperand(...)
ForExpression::setVariable(...)
ForExpression::setIteratedSet(...)
ForExpression::setBody(...)
SetExpression::setElements(..................)
RangeExpression::setLow(...)
RangeExpression::setHigh(...)
StructAccessExpression::setStructure(...)
ArrayAccessExpression::setArray(...)
ArrayAccessExpression::setAccessor(...)
FunctionCallExpression::setFunction(...)
FunctionCallExpression::setArguments(..................)
ParenthesisExpression::setEnclosedExpression(...)
IntFunctionExpression::setArgument(...)
RegexpExpression::setRegexpString(...)
TadeasKucera commented 4 years ago

Also please improve the Rule::removeString method so it deletes all traces of the yara string from formatted text.