Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for EXTERNAL OBJECT_TYPE_ARRAY and OBJECT_TYPE_STRUCTURE #1960

Open
msuiche opened this issue Sep 12, 2023 · 1 comment
Open

Support for EXTERNAL OBJECT_TYPE_ARRAY and OBJECT_TYPE_STRUCTURE #1960

msuiche opened this issue Sep 12, 2023 · 1 comment

Comments

@msuiche
Copy link

msuiche commented Sep 12, 2023

Currently, there are yr_compiler_define_*_variable functions to define EXTERNAL_VARIABLE_TYPE_* variables, but none of the EXTERNAL_* or yr_compiler_define_* functions allow the user to create OBJECT_TYPE_ARRAY or OBJECT_TYPE_STRUCTURE for more elaborated scanner features.

This would be a nice add for enhanced global variables. I've tried going through without the official functions but I end up clashing with asserts & double free malloc:
Hugal31/yara-rust#127

@msuiche
Copy link
Author

msuiche commented Sep 12, 2023

Moreover, arrays are interesting but may be unnecessary complexity that's why yr_compiler_define_*_variable was designed this way?

For instance in YARA Live Hunting we see the usage of loops for behaviour butgiven the straightforwardness comparison generally seen, loops would probably be better handled by the engine itself rather than the rule such as:

for any cmd in vt.behaviour.command_executions : (
  cmd contains "cmd.exe /Q /c"
)

vs

vt.behaviour.command_execution contains "cmd.exe /Q /c"

And things like:

for any lib in vt.behaviour.modules_loaded : (
  lib == "zlib.dll"
)

vs

vt.behaviour.module_loaded == "zlib.dll"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant