base64 modifyer not matching
bug
**Describe the bug**
The base64 modifyer does not always work and does not match a base64 string containg the search value
**To Reproduce**
rule.yar
```
rule TestRule
{
strings:
$s1 = "*/eval/*" base64
$s2 = "<?php" base64
$s3 = "base64_decode/*" base64
condition:
1 of them
}
```
```
> echo "<?php /*AAAAAAAAAAAAAAAAAAAAA*/eval/*AA*/(base64_decode/*AA*/" | base64 > ok.base64
> echo "<?php /*AAAAAAAAAAAAAAAAAAAAAA*/eval/*AA*/(base64_decode/*AA*/" | base64 > failed.base64
> yara -s rule.yar ok.base64
TestRule ok.base64
0x27:$s1: qL2V2YWwvK
0x0:$s2: PD9waH
0x38:$s3: YmFzZTY0X2RlY29kZS8q
> yara -s rule.yar failed.base64
TestRule failed.base64
0x28:$s1: Ki9ldmFsLy
0x0:$s2: PD9waH
```
**Expected behavior**
In both cases the $s3 should match
**Please complete the following information:**
- OS: Linux
- YARA version: it does not work in 4.2.3 and also not in 4.5.5
**Additional context**
yara-x seems to have the same problem
关闭于 2026-02-27 1 条评论