Browse code

removed strict yara property interpretation moved yara literal string parsing up in priority

Kevin Lin authored on 2015/02/14 04:59:04
Showing 1 changed files
... ...
@@ -3038,20 +3038,32 @@ static int load_oneyara(YR_RULE *rule, struct cl_engine *engine, unsigned int op
3038 3038
     */
3039 3039
 
3040 3040
     /*** rule specific checks ***/
3041
-    if (RULE_IS_PRIVATE(rule) || !RULE_IS_GLOBAL(rule) || RULE_IS_NULL(rule) ||
3042
-        !((rule->g_flags) & RULE_GFLAGS_REQUIRE_FILE) || ((rule->g_flags) & RULE_GFLAGS_REQUIRE_EXECUTABLE)) {
3041
+#ifdef YARA_FINISHED
3042
+    if (RULE_IS_PRIVATE(rule)) {
3043
+        cli_warnmsg("load_oneyara: private modifier for yara rule is unsupported\n");
3044
+        cli_yaramsg("RULE_IS_PRIVATE                yes\n");
3045
+    }
3046
+    if (RULE_IS_GLOBAL(rule)) {
3047
+        cli_warnmsg("load_oneyara: global modifier for yara rule is unsupported\n");
3048
+        cli_yaramsg("RULE_IS_GLOBAL                 yes\n");
3049
+    }
3050
+    if ((rule->g_flags) & RULE_GFLAGS_REQUIRE_FILE) {
3051
+        cli_warnmsg("load_oneyara: RULE_GFLAGS_REQUIRE_FILE for yara rule is unsupported\n");
3052
+        cli_yaramsg("RULE_GFLAGS_REQUIRE_FILE       yes\n");
3053
+    }
3054
+
3055
+
3056
+    if (RULE_IS_NULL(rule) || ((rule->g_flags) & RULE_GFLAGS_REQUIRE_EXECUTABLE)) {
3043 3057
 
3044 3058
         cli_warnmsg("load_oneyara: skipping %s due to unsupported rule gflags\n", rule->id);
3045 3059
 
3046
-        cli_yaramsg("RULE_IS_PRIVATE                %s\n", RULE_IS_PRIVATE(rule) ? "yes" : "no");
3047
-        cli_yaramsg("RULE_IS_GLOBAL                 %s\n", RULE_IS_GLOBAL(rule) ? "yes" : "no");
3048 3060
         cli_yaramsg("RULE_IS_NULL                   %s\n", RULE_IS_NULL(rule) ? "yes" : "no");
3049
-        cli_yaramsg("RULE_GFLAGS_REQUIRE_FILE       %s\n", ((rule->g_flags) & RULE_GFLAGS_REQUIRE_FILE) ? "yes" : "no");
3050 3061
         cli_yaramsg("RULE_GFLAGS_REQUIRE_EXECUTABLE %s\n", ((rule->g_flags) & RULE_GFLAGS_REQUIRE_EXECUTABLE) ? "yes" : "no");
3051 3062
 
3052 3063
         (*sigs)--;
3053 3064
         return CL_SUCCESS;
3054 3065
     }
3066
+#endif
3055 3067
 
3056 3068
     if(engine->cb_sigload && engine->cb_sigload("yara", rule->id, ~options & CL_DB_OFFICIAL, engine->cb_sigload_ctx)) {
3057 3069
         cli_dbgmsg("load_oneyara: skipping %s due to callback\n", rule->id);
... ...
@@ -3069,6 +3081,11 @@ static int load_oneyara(YR_RULE *rule, struct cl_engine *engine, unsigned int op
3069 3069
             cli_warnmsg("load_oneyara: skipping NULL string %s\n", string->id);
3070 3070
             //str_error++; /* kill the insertion? */
3071 3071
             continue;
3072
+#ifdef YARA_FINISHED
3073
+        } else if (STRING_IS_LITERAL(string)) {
3074
+            /* TODO - handle literal strings, short-circuits other string type handling */
3075
+            cli_yaramsg("load_oneyara: literal string: [%s] => [%s]\n", string->string, substr);
3076
+#endif
3072 3077
         } else if (STRING_IS_HEX(string)) {
3073 3078
             substr = parse_yara_hex_string(string, &ret);
3074 3079
             if (ret != CL_SUCCESS) {
... ...
@@ -3088,9 +3105,6 @@ static int load_oneyara(YR_RULE *rule, struct cl_engine *engine, unsigned int op
3088 3088
 
3089 3089
             ytable_add_string(&ytable, substr);
3090 3090
             free(substr);
3091
-        } else if (STRING_IS_LITERAL(string)) {
3092
-            /* TODO - handle literal strings */
3093
-            cli_yaramsg("load_oneyara: literal string: [%s] => [%s]\n", string->string, substr);
3094 3091
         } else if (STRING_IS_REGEXP(string)) {
3095 3092
             /* TODO - rewrite to NOT use PCRE_BYPASS */
3096 3093
             size_t length = strlen(PCRE_BYPASS) + strlen(string->string) + 3;
... ...
@@ -3175,7 +3189,7 @@ static int load_oneyara(YR_RULE *rule, struct cl_engine *engine, unsigned int op
3175 3175
             }
3176 3176
         }
3177 3177
 
3178
-
3178
+#ifdef YARA_FINISHED
3179 3179
         /* special modifier handler */
3180 3180
         if (STRING_IS_ANONYMOUS(string))
3181 3181
             cli_yaramsg("STRING_IS_ANONYMOUS       %s\n", STRING_IS_SINGLE_MATCH(string) ? "yes" : "no");
... ...
@@ -3198,6 +3212,7 @@ static int load_oneyara(YR_RULE *rule, struct cl_engine *engine, unsigned int op
3198 3198
             str_error++;
3199 3199
             continue;
3200 3200
         }
3201
+#endif
3201 3202
     }
3202 3203
 
3203 3204
     if (str_error > 0) {