Reading Multiple Values from an Array Buffer* (Feature Request)
Hello,
I have a proposal for a new feature for Yara-X that allows rule developers to reference global array buffers in the context of Yara-X's engine scanner.
For example, let's say I want to compare an attribute in the condition section against hundreds of values, **for any of them**. With the current syntax, I could do it by hardcoding every value (in the condition section) and checking for each one with an `OR` operator.
I propose a feature that gives the rule access to global array buffers of the types `uint8_t, uint16_t, uint32_t, uint64_t, float, double and string` for comparison. Other types are welcome too.
Any rule has permission to access that same buffer; no duplication is required. For example, before scanning, I could populate this buffer with values from a file on disk or from a remote server.
This feature keeps the rule clear by separating the data from the logic.
For example,
```
any of <global_buffer_of_str_type> at 0
```
```
vt.net.url.raw matches <global_buffer_of_str_type>
```
I understand that, depending on the comparison operator the rule references, every value in the global array buffer would have to be validated. Depending on the implementation, the Yara-X compiler could expand (internally) the second example as follows:
```
vt.net.url.raw matches /\/gate\/.{60}\/registerBot/ or
vt.net.url.raw matches /\/gate\/.{60}\/getFile\?name=admin_settings_plugin\.json/ or
vt.net.url.raw matches /\/gate\/.{60}\/uploadFile\?name/
```
0 条评论