mianskulls / yara-project

Automatically exported from code.google.com/p/yara-project
Apache License 2.0
0 stars 1 forks source link

Need to support negative integer META fields #50

Open GoogleCodeExporter opened 8 years ago

GoogleCodeExporter commented 8 years ago
What steps will reproduce the problem?
It would be exceptionally helpful, if YARA supported negative META fields (as 
negative integers).

Here is an example:

rule foo {

    meta:
        weight = -50

    strings:
        $header = "MZ"

    condition:
        $header at 0
}

What is the expected output? What do you see instead?
Instead of properly parsing this rule, YARA returns this type of error:

/tmp/foo.yara:4: syntax error, unexpected '-', expecting _NUMBER_ or 
_TEXTSTRING_ or _TRUE_ or _FALSE_

What version of the product are you using? On what operating system?

Yara v1.6 (Linux 64-bit)

Please provide any additional information below.

I know the workaround is to set the META field to be a string, like:

weight = "-50"

...but I'd prefer if YARA directly supported negative integers directly, rather 
than having to manually convert strings back to negative integers, because of 
this limitation.

Original issue reported on code.google.com by dar...@kindlund.com on 18 May 2012 at 1:01

GoogleCodeExporter commented 8 years ago
You might be curious to know... I've been reading through the parser stuff in 
YARA, and it appears that all integer values are of "size_t" type internally. 
("unsigned long" most of the time.) So just sticking a (\+|-)? onto the front 
of {digit}+ in lex.l doesn't quite fix this, unless you're ok with 'weight = 
-1' being the same as 'weight = 4294967295'. And I don't want to mess around 
with too much of YARA's internals until I've understood them yet...

Original comment by juliavi...@gmail.com on 4 Jul 2012 at 5:59