/
yara.coder
359 lines (310 loc) · 34.2 KB
/
yara.coder
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
;----------------------------------------------;
; Coder plugin syntax file ;
;----------------------------------------------;
;Colors
; Color need to be in #RRGGBB or #RGB format.
; If color equal to zero, then color ignored.
;
;Font styles
; 0 ignored.
; 1 normal.
; 2 bold.
; 3 italic.
; 4 bold italic.
;
;For comfort file viewing/editing set tab size to 8.
;Author: Skif_off (2024-01-24)
;AkelPad 4.9.7 and higher
;https://github.com/Lenchik/Akelpad-syntax-highlighting/blob/master/yara.coder - working version
;https://github.com/Lenchik/Akelpad-syntax-highlighting/blob/master/source_for_developers/yara.utf8.coder - development version in UTF-8 for easier development on GitHub
;
;https://yara.readthedocs.io/en/stable/index.html
;https://github.com/VirusTotal/yara
;See "Modules: functions" and "Modules: values" rules
Files:
;==========
;File types
;==========
*.yar
*.yara
;----------------------------------------------;
; HighLight ;
;----------------------------------------------;
;Flags (sum of the members)
; 1 case sensitive.
; 2 word is a composition of characters ("Words:" section only). Example: "0123456789" - highlight words that contain only digits.
; 4 quote end required ("Quotes:" section only).
; 8 quote start string is ignored and last meet delimiter used as quote start ("Quotes:" section only).
; 16 quote end string is ignored and first meet delimiter used as quote end ("Quotes:" section only).
; 32 don't highlight quote start ("Quotes:" section only).
; 64 don't highlight quote end ("Quotes:" section only).
; 128 don't catch and don't highlight quote start ("Quotes:" section only).
; 256 don't catch and don't highlight quote end ("Quotes:" section only).
; 512 quote start, delimiter or word located at line start.
; 1024 quote end, delimiter or word located at line end.
; 2048 quote start is surrounded with delimiters ("Quotes:" section only).
; 4096 quote end is surrounded with delimiters ("Quotes:" section only).
; 8192 quote doesn't contain delimiters ("Quotes:" section only).
; 16384 only quote start string is catched ("Quotes:" section only).
; 32768 quote doesn't contain any character ("Quotes:" section only).
Font:
;=================================================================
;FontStyle FontSize FaceName
;=================================================================
${HighLight_FontStyle} ${HighLight_FontSize} ${HighLight_FaceName}
Colors:
;=============================================================================================================================================================================================================================================================================================================================================================================================================================
;BasicTextColor BasicBkColor SelTextColor SelBkColor LineTextColor LineBkColor LineBorderColor AltTextColor AltBkColor AltBorderColor ColumnColor MarkerColor CaretColor UrlColor ActiveUrlColor VisitUrlColor
;=============================================================================================================================================================================================================================================================================================================================================================================================================================
${HighLight_BasicTextColor} ${HighLight_BasicBkColor} ${HighLight_SelTextColor} ${HighLight_SelBkColor} ${HighLight_LineTextColor} ${HighLight_LineBkColor} ${HighLight_LineBorderColor} ${HighLight_AltTextColor} ${HighLight_AltBkColor} ${HighLight_AltBorderColor} ${HighLight_ColumnColor} ${HighLight_MarkerColor} ${HighLight_CaretColor} ${HighLight_UrlColor} ${HighLight_ActiveUrlColor} ${HighLight_VisitUrlColor}
BkImage:
;==================================================
;BkImageFile BkImageAlpha
;==================================================
${HighLight_BkImageFile} ${HighLight_BkImageAlpha}
AutoMark:
;====================================================================================================================
;AutoMarkFlags AutoMarkFontStyle AutoMarkTextColor AutoMarkBkColor
;====================================================================================================================
${HighLight_AutoMarkFlags} ${HighLight_AutoMarkFontStyle} ${HighLight_AutoMarkTextColor} ${HighLight_AutoMarkBkColor}
Quotes:
;===================================================================================
;Flags Font Color Color Quote Quote Escape Quote Quote Parent Rule
; style text bkgrnd start end char include exclude ID ID
;===================================================================================
;5=1+4
5 3 ${STR} 0 `"` `"` "\" "" "" 0 0
;1=1
1 3 ${COMM} 0 "//" "" ":" "" "" 0 0
;5=1+4
5 3 ${COMM} 0 "/*" "*/" "" "" "" 0 0
;Special variables "any of them"
;32773=1+4+32768
32773 0 ${VAR} 0 "$" "*" "" "" "" 0 0
QuotesRE:
;==========================================================================================================
;Flags Pattern \BackRef=(FontStyle,ColorText,ColorBk) \BackRef=... ParentID RuleID
;==========================================================================================================
;Variables
1 "\$[A-Za-z_][A-Za-z0-9_]*?" "\0=(0,${VAR},0)" 0 0
;Modules: functions
1 "pe(\.[a-z][a-z0-9_]+?){1,2}" "\0=(3,${OP},0)" 0 0
1 "elf(\.[a-z][a-z0-9_]+?){1,2}" "\0=(3,${OP},0)" 0 0
1 "cuckoo(\.[a-z][a-z0-9_]+?){1,2}" "\0=(3,${OP},0)" 0 0
1 "magic\.[a-z][a-z0-9_]+?" "\0=(3,${OP},0)" 0 0
1 "hash\.[a-z][a-z0-9_]+?" "\0=(3,${OP},0)" 0 0
1 "math\.[a-z][a-z0-9_]+?" "\0=(3,${OP},0)" 0 0
1 "dotnet(\.[a-z][a-z0-9_]+?){1,2}" "\0=(3,${OP},0)" 0 0
1 "time\.now" "\0=(3,${OP},0)" 0 0
1 "console\.(hex|log)" "\0=(3,${OP},0)" 0 0
1 "string\.(length|to_int)" "\0=(3,${OP},0)" 0 0
1 "lnk(\.[a-z][a-z0-9_]+?){1,2}" "\0=(3,${OP},0)" 0 0
;Modules: values
1 "pe\.[A-Z][A-Z0-9_]+?" "\0=(0,${VAR},0)" 0 0
1 "elf\.[A-Z][A-Z0-9_]+?" "\0=(0,${VAR},0)" 0 0
1 "cuckoo\.[A-Z][A-Z0-9_]+?" "\0=(0,${VAR},0)" 0 0
1 "lnk\.[A-Z][A-Z0-9_]+?" "\0=(0,${VAR},0)" 0 0
Delimiters:
;===============================================
;Flags Font Color Color Char(s) Parent
; style text bkgrnd ID
;===============================================
1 0 0 0 " "
1 0 0 0 " "
1 0 ${DEL1} 0 (
1 0 ${DEL1} 0 )
1 0 ${DEL1} 0 {
1 0 ${DEL1} 0 }
1 0 ${DEL2} 0 .
1 0 ${DEL2} 0 ,
1 0 ${DEL2} 0 :
1 0 ${DEL2} 0 ;
1 0 ${DEL2} 0 !
1 0 ${DEL2} 0 ~
1 0 ${DEL2} 0 |
1 0 ${DEL2} 0 =
1 0 ${DEL2} 0 -
1 0 ${DEL2} 0 *
1 0 ${DEL2} 0 +
1 0 ${DEL2} 0 /
1 0 ${DEL2} 0 <
1 0 ${DEL2} 0 >
1 0 ${DEL2} 0 &
1 0 ${DEL2} 0 ^
1 0 ${DEL2} 0 %
1 0 ${DEL2} 0 ?
1 0 ${DEL1} 0 [
1 0 ${DEL1} 0 ]
1 0 ${DEL1} 0 @
Words:
;===========================================
;Flags Font Color Color Word Parent
; style text bkgrnd ID
;===========================================
1 2 ${OP} 0 rule
1 2 ${OP} 0 meta
1 2 ${OP} 0 strings
1 2 ${OP} 0 condition
;
1 0 ${OP} 0 import
1 0 ${OP} 0 include
;
1 0 ${OP} 0 global
1 0 ${OP} 0 private
;
1 0 ${OP} 0 int8
1 0 ${OP} 0 int8be
1 0 ${OP} 0 int16
1 0 ${OP} 0 int16be
1 0 ${OP} 0 int32
1 0 ${OP} 0 int32be
1 0 ${OP} 0 uint8
1 0 ${OP} 0 uint8be
1 0 ${OP} 0 uint16
1 0 ${OP} 0 uint16be
1 0 ${OP} 0 uint32
1 0 ${OP} 0 uint32be
;
1 0 ${TAG} 0 false
1 0 ${TAG} 0 true
;Conditions, operators and other
1 0 ${IF} 0 and
1 0 ${IF} 0 any
1 0 ${IF} 0 all
1 0 ${IF} 0 none
1 0 ${IF} 0 at
1 0 ${IF} 0 contains
1 0 ${IF} 0 defined
1 0 ${IF} 0 endswith
1 0 ${IF} 0 for
1 0 ${IF} 0 icontains
1 0 ${IF} 0 iendswith
1 0 ${IF} 0 iequals
1 0 ${IF} 0 in
1 0 ${IF} 0 istartswith
1 0 ${IF} 0 matches
1 0 ${IF} 0 not
1 0 ${IF} 0 of
1 0 ${IF} 0 or
1 0 ${IF} 0 startswith
1 0 ${IF} 0 them
;Modifiers
1 0 ${DEL1} 0 ascii
1 0 ${DEL1} 0 base64
1 0 ${DEL1} 0 base64wide
1 0 ${DEL1} 0 fullword
1 0 ${DEL1} 0 nocase
1 0 ${DEL1} 0 private
1 0 ${DEL1} 0 wide
1 0 ${DEL1} 0 xor
;Special variables
1 0 ${VAR} 0 filesize
;Special variables (deprecated)
1 0 ${VAR} 0 entrypoint
;----------------------------------------------;
; CodeFold ;
;----------------------------------------------;
;Flags (sum of the members)
; 1 case sensitive.
; 2 force get fold name for function list from left at the fold start ("Folds:" section only).
; 4 force get fold name for function list from right at the fold start, including fold start ("Folds:" section only).
; 8 fold start ("Folds:" section) or skip start ("Skips:" section) located at line start.
; 16 fold start ("Folds:" section) or skip start ("Skips:" section) located at line end.
; 32 fold end ("Folds:" section) or skip end ("Skips:" section) located at line start.
; 64 fold end ("Folds:" section) or skip end ("Skips:" section) located at line end.
; 128 don't catch fold end ("Folds:" section) or skip end ("Skips:" section).
; 256 additional to 128 flag - more priority is given to sibling level instead of parent level ("Folds:" section only).
; 512 comment fold - fold ignore any other folds and skips inside ("Folds:" section only).
; 1024 reserved.
; 2048 deny fold - founded fold will be ignored ("Folds:" section only).
; 4096 xml fold - "<tag" and "</tag>", "<single" and "/>", "<single" and ">" ("Folds:" section only).
; 8192 don't check delimiters from left of fold start ("Folds:" section only).
; 16384 don't check delimiters from right of fold start ("Folds:" section only).
; 32768 don't check delimiters from left of fold end ("Folds:" section only).
; 65536 don't check delimiters from right of fold end ("Folds:" section only).
; 131072 deny delimiters ("Folds:" section only).
; 262144 don't show fold in list ("Folds:" section only).
; 1048576 regular expression in fold start ("Folds:" section) or skip start ("Skips:" section).
; 2097152 regular expression in fold end ("Folds:" section) or skip end ("Skips:" section).
FoldPanel:
;=================================================================================================================================================================================================================================================================================================================================================================================================================================================================
;PanelFirstBkColor PanelSecondBkColor PanelNormalFoldColor PanelActiveFoldColor PanelNormalNodeOpenBkColor PanelNormalNodeCloseBkColor PanelActiveNodeOpenBkColor PanelActiveNodeCloseBkColor PanelNormalNodeOpenSignColor PanelNormalNodeCloseSignColor PanelActiveNodeOpenSignColor PanelActiveNodeCloseSignColor
;=================================================================================================================================================================================================================================================================================================================================================================================================================================================================
${CodeFold_PanelFirstBkColor} ${CodeFold_PanelSecondBkColor} ${CodeFold_PanelNormalFoldColor} ${CodeFold_PanelActiveFoldColor} ${CodeFold_PanelNormalNodeOpenBkColor} ${CodeFold_PanelNormalNodeCloseBkColor} ${CodeFold_PanelActiveNodeOpenBkColor} ${CodeFold_PanelActiveNodeCloseBkColor} ${CodeFold_PanelNormalNodeOpenSignColor} ${CodeFold_PanelNormalNodeCloseSignColor} ${CodeFold_PanelActiveNodeOpenSignColor} ${CodeFold_PanelActiveNodeCloseSignColor}
FoldList:
;================================================
;ListTextColor ListBkColor
;================================================
${CodeFold_ListTextColor} ${CodeFold_ListBkColor}
TagMark:
;============================================================================================================
;TagMarkFlags TagMarkFontStyle TagMarkTextColor TagMarkBkColor
;============================================================================================================
${CodeFold_TagMarkFlags} ${CodeFold_TagMarkFontStyle} ${CodeFold_TagMarkTextColor} ${CodeFold_TagMarkBkColor}
Skips:
;=============================
;Flags Skip Skip Escape
; start end char
;=============================
1 `"` `"` "\"
1 "//" "" ":"
Folds:
;===================================================================================
;Flags Font Color Color Fold Fold Deli Parent Rule Rule
; style text bkgrnd start end miters ID ID file
;===================================================================================
1 0 0 0 "{" "}" "" 0 0
;513=1+512
513 3 ${COMM} 0 "/*" "*/" "" 0 0
;----------------------------------------------;
; AutoComplete ;
;----------------------------------------------;
;Flags (sum of the members)
; 1 force case sensitive.
; 2 force case insensitive.
; 4 regular expression (only for "$="). Scan starts from caret line beginning and metacharacters \a or \z specified caret position.
; 8 Don't show in listbox.
CompleteList:
;=====================================================================================================================================================================================================================================================================================================================================================================================================================================================================
;ListFontStyle ListFontSize ListFaceName ListLineGap ListBlockIcon `"C:\1.dll", 0` ListBlockIconMargins "left;right" ListHlBaseIcon `"C:\1.dll", 0` ListHlBaseIconMargins "left;right" ListDocWordIcon `"C:\1.dll", 0` ListDocWordIconMargins "left;right" ListBasicTextColor ListBasicBkColor ListSelTextColor ListSelBkColor
;=====================================================================================================================================================================================================================================================================================================================================================================================================================================================================
${AutoComplete_ListFontStyle} ${AutoComplete_ListFontSize} ${AutoComplete_ListFaceName} ${AutoComplete_ListLineGap} ${AutoComplete_ListBlockIcon} ${AutoComplete_ListBlockIconMargins} ${AutoComplete_ListHlBaseIcon} ${AutoComplete_ListHlBaseIconMargins} ${AutoComplete_ListDocWordIcon} ${AutoComplete_ListDocWordIconMargins} ${AutoComplete_ListBasicTextColor} ${AutoComplete_ListBasicBkColor} ${AutoComplete_ListSelTextColor} ${AutoComplete_ListSelBkColor}
Blocks:
;=============================================================================
;Abbreviations and blocks
;
; $~abbr normal abbreviation.
; $(flags)~abbr normal abbreviation with flags.
; $=abbr exact abbreviation. May contain delimiters.
; $(flags)=abbr exact abbreviation with flags. May contain delimiters.
; $[] set caret to this position. Can be multiple (hot spots).
; $[text] select text. Can be multiple (hot spots).
; $$ symbol $.
; $\] escape symbol ]. Can be used in $[text] block: $[One [1$\] ].
; ${VAR} variable assigned from Coder::Settings.
; $; comment line.
;=============================================================================
$~rule...condition
rule $[]
{
${AutoComplete_Indent}condition:
${AutoComplete_Indent}${AutoComplete_Indent}$[]
}
$~rule...strings...condition
rule $[]
{
${AutoComplete_Indent}strings:
${AutoComplete_Indent}${AutoComplete_Indent}$[]
${AutoComplete_Indent}condition:
${AutoComplete_Indent}${AutoComplete_Indent}$[]
}
$~rule...meta...strings...condition
rule $[]
{
${AutoComplete_Indent}meta:
${AutoComplete_Indent}${AutoComplete_Indent}$[]
${AutoComplete_Indent}strings:
${AutoComplete_Indent}${AutoComplete_Indent}$[]
${AutoComplete_Indent}condition:
${AutoComplete_Indent}${AutoComplete_Indent}$[]
}