You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, Yara v1.6 supports Addition, Subtraction, Multiplication, and Division (+,-,,) However, modular division is not supported. This isn't a huge problem, because you can just do something like: X - (n(X/n)) rather than just writing X%n, but the later is easier to read...
For example, to verify the check-bits on a zlib stream, you'd currently need to write something like this:
From juliavi...@gmail.com on April 27, 2012 01:32:10
Currently, Yara v1.6 supports Addition, Subtraction, Multiplication, and Division (+,-,,) However, modular division is not supported. This isn't a huge problem, because you can just do something like: X - (n(X/n)) rather than just writing X%n, but the later is easier to read...
For example, to verify the check-bits on a zlib stream, you'd currently need to write something like this:
0 == ((uint8(0)<<8)|uint8(1)) - ( 31 * (((uint8(0)<<8)|uint8(1))\31))
With a native modulus operator in the Yara syntax, you could just write:
0 == (uint8(0)<<8)|uint8(1)) % 31
With support for big-endian WORDs and DWORDs (See: Issue #38 ) this could be written simply as:
0 == uintb16(0) % 31
// .. or however the syntax would look. Something like pack() and unpack() from Perl and Python would be good for exactly specifying types.
Original issue: http://code.google.com/p/yara-project/issues/detail?id=43
The text was updated successfully, but these errors were encountered: