Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Multiline strings in meta section. #2074

Closed
wants to merge 2 commits into from

Conversation

wxsBSD
Copy link
Collaborator

@wxsBSD wxsBSD commented May 2, 2024

This commit implements multiline strings in the meta section. It is now possible to do the following:

rule a {
meta:
b = """
This is a multiline string literal.

\x41

Hooray!
"""
condition:
true
}

Escape sequences are handled so the sequence "\x41" in the above example comes out to a single 'A'. Everything else is copied into the rule verbatim.

This is different behavior from regular strings in that things like "\t" are converted to a single byte (0x09). If you want a tab character in your multiline string, you must put it in yourself. Same goes for newlines.

wxsBSD added 2 commits May 2, 2024 16:06
This commit implements multiline strings in the meta section. It is now possible
to do the following:

rule a {
  meta:
    b = """
This is a multiline string literal.

	\x41

Hooray!
"""
  condition:
    true
}

Escape sequences are handled so the sequence "\x41" in the above example comes
out to a single 'A'. Everything else is copied into the rule verbatim.

This is different behavior from regular strings in that things like "\t" are
converted to a single byte (0x09). If you want a tab character in your
multiline string, you must put it in yourself. Same goes for newlines.
@wxsBSD
Copy link
Collaborator Author

wxsBSD commented May 20, 2024

Going to close this out and implement it in yara-x instead.

@wxsBSD wxsBSD closed this May 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant