...
|
...
|
@@ -3038,20 +3038,32 @@ static int load_oneyara(YR_RULE *rule, struct cl_engine *engine, unsigned int op
|
3038
|
3038
|
*/
|
3039
|
3039
|
|
3040
|
3040
|
/*** rule specific checks ***/
|
3041
|
|
- if (RULE_IS_PRIVATE(rule) || !RULE_IS_GLOBAL(rule) || RULE_IS_NULL(rule) ||
|
3042
|
|
- !((rule->g_flags) & RULE_GFLAGS_REQUIRE_FILE) || ((rule->g_flags) & RULE_GFLAGS_REQUIRE_EXECUTABLE)) {
|
|
3041
|
+#ifdef YARA_FINISHED
|
|
3042
|
+ if (RULE_IS_PRIVATE(rule)) {
|
|
3043
|
+ cli_warnmsg("load_oneyara: private modifier for yara rule is unsupported\n");
|
|
3044
|
+ cli_yaramsg("RULE_IS_PRIVATE yes\n");
|
|
3045
|
+ }
|
|
3046
|
+ if (RULE_IS_GLOBAL(rule)) {
|
|
3047
|
+ cli_warnmsg("load_oneyara: global modifier for yara rule is unsupported\n");
|
|
3048
|
+ cli_yaramsg("RULE_IS_GLOBAL yes\n");
|
|
3049
|
+ }
|
|
3050
|
+ if ((rule->g_flags) & RULE_GFLAGS_REQUIRE_FILE) {
|
|
3051
|
+ cli_warnmsg("load_oneyara: RULE_GFLAGS_REQUIRE_FILE for yara rule is unsupported\n");
|
|
3052
|
+ cli_yaramsg("RULE_GFLAGS_REQUIRE_FILE yes\n");
|
|
3053
|
+ }
|
|
3054
|
+
|
|
3055
|
+
|
|
3056
|
+ if (RULE_IS_NULL(rule) || ((rule->g_flags) & RULE_GFLAGS_REQUIRE_EXECUTABLE)) {
|
3043
|
3057
|
|
3044
|
3058
|
cli_warnmsg("load_oneyara: skipping %s due to unsupported rule gflags\n", rule->id);
|
3045
|
3059
|
|
3046
|
|
- cli_yaramsg("RULE_IS_PRIVATE %s\n", RULE_IS_PRIVATE(rule) ? "yes" : "no");
|
3047
|
|
- cli_yaramsg("RULE_IS_GLOBAL %s\n", RULE_IS_GLOBAL(rule) ? "yes" : "no");
|
3048
|
3060
|
cli_yaramsg("RULE_IS_NULL %s\n", RULE_IS_NULL(rule) ? "yes" : "no");
|
3049
|
|
- cli_yaramsg("RULE_GFLAGS_REQUIRE_FILE %s\n", ((rule->g_flags) & RULE_GFLAGS_REQUIRE_FILE) ? "yes" : "no");
|
3050
|
3061
|
cli_yaramsg("RULE_GFLAGS_REQUIRE_EXECUTABLE %s\n", ((rule->g_flags) & RULE_GFLAGS_REQUIRE_EXECUTABLE) ? "yes" : "no");
|
3051
|
3062
|
|
3052
|
3063
|
(*sigs)--;
|
3053
|
3064
|
return CL_SUCCESS;
|
3054
|
3065
|
}
|
|
3066
|
+#endif
|
3055
|
3067
|
|
3056
|
3068
|
if(engine->cb_sigload && engine->cb_sigload("yara", rule->id, ~options & CL_DB_OFFICIAL, engine->cb_sigload_ctx)) {
|
3057
|
3069
|
cli_dbgmsg("load_oneyara: skipping %s due to callback\n", rule->id);
|
...
|
...
|
@@ -3069,6 +3081,11 @@ static int load_oneyara(YR_RULE *rule, struct cl_engine *engine, unsigned int op
|
3069
|
3069
|
cli_warnmsg("load_oneyara: skipping NULL string %s\n", string->id);
|
3070
|
3070
|
//str_error++; /* kill the insertion? */
|
3071
|
3071
|
continue;
|
|
3072
|
+#ifdef YARA_FINISHED
|
|
3073
|
+ } else if (STRING_IS_LITERAL(string)) {
|
|
3074
|
+ /* TODO - handle literal strings, short-circuits other string type handling */
|
|
3075
|
+ cli_yaramsg("load_oneyara: literal string: [%s] => [%s]\n", string->string, substr);
|
|
3076
|
+#endif
|
3072
|
3077
|
} else if (STRING_IS_HEX(string)) {
|
3073
|
3078
|
substr = parse_yara_hex_string(string, &ret);
|
3074
|
3079
|
if (ret != CL_SUCCESS) {
|
...
|
...
|
@@ -3088,9 +3105,6 @@ static int load_oneyara(YR_RULE *rule, struct cl_engine *engine, unsigned int op
|
3088
|
3088
|
|
3089
|
3089
|
ytable_add_string(&ytable, substr);
|
3090
|
3090
|
free(substr);
|
3091
|
|
- } else if (STRING_IS_LITERAL(string)) {
|
3092
|
|
- /* TODO - handle literal strings */
|
3093
|
|
- cli_yaramsg("load_oneyara: literal string: [%s] => [%s]\n", string->string, substr);
|
3094
|
3091
|
} else if (STRING_IS_REGEXP(string)) {
|
3095
|
3092
|
/* TODO - rewrite to NOT use PCRE_BYPASS */
|
3096
|
3093
|
size_t length = strlen(PCRE_BYPASS) + strlen(string->string) + 3;
|
...
|
...
|
@@ -3175,7 +3189,7 @@ static int load_oneyara(YR_RULE *rule, struct cl_engine *engine, unsigned int op
|
3175
|
3175
|
}
|
3176
|
3176
|
}
|
3177
|
3177
|
|
3178
|
|
-
|
|
3178
|
+#ifdef YARA_FINISHED
|
3179
|
3179
|
/* special modifier handler */
|
3180
|
3180
|
if (STRING_IS_ANONYMOUS(string))
|
3181
|
3181
|
cli_yaramsg("STRING_IS_ANONYMOUS %s\n", STRING_IS_SINGLE_MATCH(string) ? "yes" : "no");
|
...
|
...
|
@@ -3198,6 +3212,7 @@ static int load_oneyara(YR_RULE *rule, struct cl_engine *engine, unsigned int op
|
3198
|
3198
|
str_error++;
|
3199
|
3199
|
continue;
|
3200
|
3200
|
}
|
|
3201
|
+#endif
|
3201
|
3202
|
}
|
3202
|
3203
|
|
3203
|
3204
|
if (str_error > 0) {
|