ITADN

Reading Multiple Values from an Array Buffer* (Feature Request)

#642OpenMFMokbel 创建于 2026-04-26
M
MFMokbelcommented
Hello, I have a proposal for a new feature for Yara-X that allows rule developers to reference global array buffers in the context of Yara-X's engine scanner. For example, let's say I want to compare an attribute in the condition section against hundreds of values, **for any of them**. With the current syntax, I could do it by hardcoding every value (in the condition section) and checking for each one with an `OR` operator. I propose a feature that gives the rule access to global array buffers of the types `uint8_t, uint16_t, uint32_t, uint64_t, float, double and string` for comparison. Other types are welcome too. Any rule has permission to access that same buffer; no duplication is required. For example, before scanning, I could populate this buffer with values from a file on disk or from a remote server. This feature keeps the rule clear by separating the data from the logic. For example, ``` any of <global_buffer_of_str_type> at 0 ``` ``` vt.net.url.raw matches <global_buffer_of_str_type> ``` I understand that, depending on the comparison operator the rule references, every value in the global array buffer would have to be validated. Depending on the implementation, the Yara-X compiler could expand (internally) the second example as follows: ``` vt.net.url.raw matches /\/gate\/.{60}\/registerBot/ or vt.net.url.raw matches /\/gate\/.{60}\/getFile\?name=admin_settings_plugin\.json/ or vt.net.url.raw matches /\/gate\/.{60}\/uploadFile\?name/ ```
0 条评论