Modulus operator conspicuously missing

[plusvic]

From juliavi...@gmail.com on April 27, 2012 01:32:10

Currently, Yara v1.6 supports Addition, Subtraction, Multiplication, and Division (+,-,,) However, modular division is not supported. This isn't a huge problem, because you can just do something like: X - (n(X/n)) rather than just writing X%n, but the later is easier to read...

For example, to verify the check-bits on a zlib stream, you'd currently need to write something like this:

0 == ((uint8(0)<<8)|uint8(1)) - ( 31 * (((uint8(0)<<8)|uint8(1))\31))

With a native modulus operator in the Yara syntax, you could just write:

0 == (uint8(0)<<8)|uint8(1)) % 31

With support for big-endian WORDs and DWORDs (See: Issue #38 ) this could be written simply as:

0 == uintb16(0) % 31

// .. or however the syntax would look. Something like pack() and unpack() from Perl and Python would be good for exactly specifying types.

Original issue: http://code.google.com/p/yara-project/issues/detail?id=43

[plusvic]

From juliavi...@gmail.com on July 03, 2012 21:18:52

I've added a patch for this, attached to issue 54 .

[plusvic]

From plus...@gmail.com on August 15, 2012 08:40:18

Fixed in r154 . See issue 54 .

Status: Fixed