Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Expanding support for global variable objects. #114

Open
msuiche opened this issue May 21, 2024 · 2 comments
Open

Expanding support for global variable objects. #114

msuiche opened this issue May 21, 2024 · 2 comments
Labels
enhancement New feature or request

Comments

@msuiche
Copy link

msuiche commented May 21, 2024

This is something which was lacking in the C version, according to the current documentation yara-x only supports "global external variable" but not "external object" which would include arrays and structures for richer data enrichment.

This could be really great for modules that would want to keep the same name convention of VirusTotal live hunting to make rules interoperable for example variables like vt.behaviour.command_executions or vt.behaviour.modules_loaded which are only accessible as an array via the for loop keyword. But also variables under specific structures such as vt.behaviour.

More information about existing issues which were not addressable in the current C version of yara:
Support for EXTERNAL OBJECT_TYPE_ARRAY and OBJECT_TYPE_STRUCTURE
Exporting yr_object_create() to enable custom structures?

@plusvic
Copy link
Member

plusvic commented May 21, 2024

This is something that I have in mind for future releases. I'm currently focused in releasing a version that has feature parity with yara, but more advanced features like this are in the plan.

@plusvic plusvic added the enhancement New feature or request label May 21, 2024
@msuiche
Copy link
Author

msuiche commented May 21, 2024

Excellent! Amazing job as usual @plusvic !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants