Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added unary operation defined #1529

Merged
merged 6 commits into from
Oct 21, 2021

Conversation

xbabka01
Copy link
Contributor

YARA didn't support any expression which would check value against YR_UNDEFINED constant so checking for non-existence of something can be very problematic. But we run multiple times into issue of people asking us for checking of absence of something.

Because of this we propose operator defined which would be unary operator (like not) which works like this:

defined x evaluates to

true - whenever x != YR_UNDEFINED
false - whenever x == YR_UNDEFINED

Related to issue #835

…efined

# Conflicts:
#	docs/writingrules.rst
#	libyara/grammar.c
#	libyara/grammar.h
#	libyara/include/yara/exec.h
#	libyara/lexer.c
#	tests/test-rules.c
@plusvic plusvic merged commit dc4e009 into VirusTotal:master Oct 21, 2021
@xbabka01 xbabka01 deleted the unary_operation_defined branch October 21, 2021 09:42
tarterp pushed a commit to mandiant/yara that referenced this pull request Mar 31, 2022
YARA didn't support any expression which would check value against YR_UNDEFINED constant so checking for non-existence of something can be very problematic. But we run multiple times into issue of people asking us for checking of absence of something.

Because of this we propose operator defined which would be unary operator (like not) which works like this:

defined x evaluates to

true - whenever x != YR_UNDEFINED
false - whenever x == YR_UNDEFINED

Related to issue VirusTotal#835
maximelb pushed a commit to refractionPOINT/yara that referenced this pull request Nov 17, 2022
YARA didn't support any expression which would check value against YR_UNDEFINED constant so checking for non-existence of something can be very problematic. But we run multiple times into issue of people asking us for checking of absence of something.

Because of this we propose operator defined which would be unary operator (like not) which works like this:

defined x evaluates to

true - whenever x != YR_UNDEFINED
false - whenever x == YR_UNDEFINED

Related to issue VirusTotal#835
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants