Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Generate UIDs for AST nodes with Expression base class #218

Merged
merged 5 commits into from
Jun 9, 2022

Conversation

HoundThe
Copy link
Member

@HoundThe HoundThe commented Jun 7, 2022

I've added UIDGenerator as part of the ParserDriver, which assigns UIDs to AST nodes that have class Expression as their base class.

The UIDs are supposed to be unique for a given input and deterministic, they are implemented using a 64bit resettable counter. The counter is reset when new parsing input is provided using the existing prepareParser() function and when the condition rule is applied, so it's reset before parsing each condition.

I've modified the existing rule condition AST dumper example code, to print the UIDs and for input:

rule ExampleRule
{
    strings:
        $my_text_string = "text here"
        $my_hex_string = { E2 34 A1 C8 23 FB }
        $a = "text1"
    condition:
        $my_text_string or $my_hex_string and
		not $a or false
}

rule ExampleRule1
{
    strings:
        $my_text_string = "text here" private
        $my_hex_string = { E2 34 A1 C8 23 FB }
        $a = "text1"
        $b = "text2"
        $c = "text3"
        $d = "text4"
    condition:
        ($a or $b) and ($c or $d)
        or (#a == 6 and #b > 10) and
        any of them
}

I get the following output:

==== RULE: ExampleRule
Or[0x55c587337c60]  uid=7
    Or[0x55c587335840]  uid=5
        String[0x55c587318880]  id=$my_text_string uid=0
        And[0x55c5873357d0]  uid=4
            String[0x55c587334230]  id=$my_hex_string uid=1
            Not[0x55c587332890]  uid=3
                String[0x55c587335720]  id=$a uid=2
    BoolLiteral[0x55c587337660]  value=false uid=6
==== RULE: ExampleRule1
Or[0x55c587346980]  uid=21
    And[0x55c5873414a0]  uid=8
        Parentheses[0x55c587340bb0]  uid=3
            Or[0x55c587340590]  uid=2
                String[0x55c58731b910]  id=$a uid=0
                String[0x55c587340540]  id=$b uid=1
        Parentheses[0x55c587341430]  uid=7
            Or[0x55c5873411c0]  uid=6
                String[0x55c587340f20]  id=$c uid=4
                String[0x55c587341170]  id=$d uid=5
    And[0x55c587346910]  uid=20
        Parentheses[0x55c587344c20]  uid=16
            And[0x55c587344ab0]  uid=15
                Equal[0x55c587343b40]  uid=11
                    StringCount[0x55c587342f20]  id=#a uid=9
                    IntLiteral[0x55c587343840]  value=6 uid=10
                GreaterThan[0x55c587344a40]  uid=14
                    StringCount[0x55c5873441b0]  id=#b uid=12
                    IntLiteral[0x55c5873449f0]  value=10 uid=13
        Of[0x55c587346870]  uid=19
            Any[0x55c5873464b0]  uid=17
            Them[0x55c587346820]  uid=18

@HoundThe HoundThe requested a review from metthal June 7, 2022 16:55
Copy link
Member

@metthal metthal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we please also mention this in a documentation in docs folder which is then getting generated for our ReadTheDocs? Otherwise, looks good and I think this would suffice.

src/python/yaramod_python.cpp Outdated Show resolved Hide resolved
include/yaramod/types/expression.h Outdated Show resolved Hide resolved
…on binding to be a property instead of method.
@HoundThe
Copy link
Member Author

HoundThe commented Jun 8, 2022

Thanks a lot for the review! I've incorporated the feedback.

@HoundThe HoundThe requested a review from metthal June 8, 2022 21:56
src/python/yaramod_python.cpp Outdated Show resolved Hide resolved
@metthal metthal merged commit 2af39f2 into master Jun 9, 2022
@metthal metthal deleted the expression-uid branch June 9, 2022 10:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants