ITADN

base64 modifyer not matching

#2193Closedzagge-cgeo 创建于 2026-02-27
bug
Z
zagge-cgeocommented
**Describe the bug** The base64 modifyer does not always work and does not match a base64 string containg the search value **To Reproduce** rule.yar ``` rule TestRule { strings: $s1 = "*/eval/*" base64 $s2 = "<?php" base64 $s3 = "base64_decode/*" base64 condition: 1 of them } ``` ``` > echo "<?php /*AAAAAAAAAAAAAAAAAAAAA*/eval/*AA*/(base64_decode/*AA*/" | base64 > ok.base64 > echo "<?php /*AAAAAAAAAAAAAAAAAAAAAA*/eval/*AA*/(base64_decode/*AA*/" | base64 > failed.base64 > yara -s rule.yar ok.base64 TestRule ok.base64 0x27:$s1: qL2V2YWwvK 0x0:$s2: PD9waH 0x38:$s3: YmFzZTY0X2RlY29kZS8q > yara -s rule.yar failed.base64 TestRule failed.base64 0x28:$s1: Ki9ldmFsLy 0x0:$s2: PD9waH ``` **Expected behavior** In both cases the $s3 should match **Please complete the following information:** - OS: Linux - YARA version: it does not work in 4.2.3 and also not in 4.5.5 **Additional context** yara-x seems to have the same problem
关闭于 2026-02-27 1 条评论