You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is something which was lacking in the C version, according to the current documentation yara-x only supports "global external variable" but not "external object" which would include arrays and structures for richer data enrichment.
This could be really great for modules that would want to keep the same name convention of VirusTotal live hunting to make rules interoperable for example variables like vt.behaviour.command_executions or vt.behaviour.modules_loaded which are only accessible as an array via the for loop keyword. But also variables under specific structures such as vt.behaviour.
This is something that I have in mind for future releases. I'm currently focused in releasing a version that has feature parity with yara, but more advanced features like this are in the plan.
This is something which was lacking in the C version, according to the current documentation yara-x only supports "global external variable" but not "external object" which would include arrays and structures for richer data enrichment.
This could be really great for modules that would want to keep the same name convention of VirusTotal live hunting to make rules interoperable for example variables like
vt.behaviour.command_executions
orvt.behaviour.modules_loaded
which are only accessible as an array via thefor
loop keyword. But also variables under specific structures such asvt.behaviour
.More information about existing issues which were not addressable in the current C version of yara:
Support for EXTERNAL OBJECT_TYPE_ARRAY and OBJECT_TYPE_STRUCTURE
Exporting yr_object_create() to enable custom structures?
The text was updated successfully, but these errors were encountered: