YARA 1.7 failing to detect a one-byte string at the end of a two-bytes file

mustangV / yara-project

Automatically exported from code.google.com/p/yara-project

Apache License 2.0

0 stars 0 forks source link

Open GoogleCodeExporter opened 8 years ago

GoogleCodeExporter commented 8 years ago

This rule...

rule flawed
{
strings: 
    $a = {FF} 
condition: 
    $a
}

...fails with this file:

00 FF

This doesn't affect YARA 2.0

Original issue reported on code.google.com by plus...@gmail.com on 3 Sep 2013 at 2:47