mustangV / yara-project

Automatically exported from code.google.com/p/yara-project
Apache License 2.0
0 stars 0 forks source link

wide option prints matches in wide instead of non-wide/ascii #74

Open GoogleCodeExporter opened 8 years ago

GoogleCodeExporter commented 8 years ago
What steps will reproduce the problem?
1.Default output of string matches to non-wide/ascii instead of wide so that 
it's human readable when extracted from a wide match.

What is the expected output? What do you see instead?
domain.com instead of the wide output of something like smi.o
$ value instead of @ wide value

What version of the product are you using? On what operating system?
latest and greatest on ubuntu.

Original issue reported on code.google.com by ken.dunh...@gmail.com on 4 Feb 2013 at 10:24

GoogleCodeExporter commented 8 years ago
To add onto this issue, YARA appears to be hitting on an ASCII match, but 
printing the string results as unicode.

test file (in ASCII):
TESTING
ONETWO
YARATHREE

Rule1:
rule test
{
 strings:
   $s0 = "test" nocase ascii wide
   $s1 = "yara" nocase ascii wide

 condition:
   $s0 and $s1
}

Execution:
yara -s rule.yara test.txt
test test.txt
0x11:$s1: YR
0x0:$s0: TS

Change rule to remove "wide" from strings:

Rule1:
rule test
{
 strings:
   $s0 = "test" nocase ascii 
   $s1 = "yara" nocase ascii 

 condition:
   $s0 and $s1
}

Execution:
yara -s rule.yara test.txt
test test.txt
0x11:$s1: YARA
0x0:$s0: TEST

Original comment by brian@thebaskins.com on 22 Jul 2013 at 7:19