Support for XOR bitwise operator

[GoogleCodeExporter]

Because Yara currently don't support xor bitwise operator, so we have to 
emulate it and is more hard to write and understand the rules.

Now I have to do that:

(((uint8(@a[1]-237) | uint8(@a[1]-3))-(uint8(@a[1]-237) & uint8(@a[1]-3))) == 
0x33)

And will be better do that:

(uint8(@a[1]-237)^uint8(@a[1]-3) == 0x33)

Thank you!

Original issue reported on code.google.com by golgotr...@gmail.com on 31 May 2012 at 2:18

[GoogleCodeExporter]

I've added support for both a bitwise xor operator, and... a modular division 
operator (see issue 43). I've only done limited testing so far, but the 
modifications seem to work. I've attached a patch (against svn r153) which will 
add these two operators. You will use xor and mod exactly as you would expect 
to, 'x^y' and 'x%y'.

Perhaps these changes will be make 'official'...

Original comment by juliavi...@gmail.com on 4 Jul 2012 at 4:17

Attachments:

• yara_xor_mod_ops.patch

[GoogleCodeExporter]

Hi Julia, your patch is great, I've included it in r154. Just missed specifying 
the correct precedence for operators (see r155)

Original comment by plus...@gmail.com on 4 Jul 2012 at 9:01

• Changed state: Fixed