odin1314 / yara-project

Automatically exported from code.google.com/p/yara-project
Apache License 2.0
0 stars 0 forks source link

Modulus operator conspicuously missing #43

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
Currently, Yara v1.6 supports Addition, Subtraction, Multiplication, and 
Division (+,-,*,\) However, modular division is not supported. This isn't a 
huge problem, because you can just do something like: X - (n*(X/n)) rather than 
just writing X%n, but the later is easier to read...

For example, to verify the check-bits on a zlib stream, you'd currently need to 
write something like this:

0 == ((uint8(0)<<8)|uint8(1)) - ( 31 * (((uint8(0)<<8)|uint8(1))\31))

With a native modulus operator in the Yara syntax, you could just write:

0 == (uint8(0)<<8)|uint8(1)) % 31

With support for big-endian WORDs and DWORDs (See: <a 
href="/p/yara-project/issues/detail?id=38">Issue #38</a>) this could be written 
simply as:

0 == uintb16(0) % 31 

// .. or however the syntax would look. Something like pack() and unpack() from 
Perl and Python would be good for exactly specifying types.

Original issue reported on code.google.com by juliavi...@gmail.com on 26 Apr 2012 at 11:32

GoogleCodeExporter commented 9 years ago
I've added a patch for this, attached to issue 54.

Original comment by juliavi...@gmail.com on 4 Jul 2012 at 4:18

GoogleCodeExporter commented 9 years ago
Fixed in r154. See issue 54.

Original comment by plus...@gmail.com on 15 Aug 2012 at 3:40