@@ -765,6 +765,7 @@ static int yara_eval(cli_ctx *ctx, struct cli_matcher *root, struct cli_ac_data

         if (target_info->status == 1)   

             context.entry_point = target_info->exeinfo.ep;

     }

+    context.fmap = *ctx->fmap;

     rc = yr_execute_code(ac_lsig, acdata, &context, 0, 0);

@@ -199,10 +199,10 @@ typedef struct _YR_SCAN_CONTEXT

   int flags;

   void* user_data;

-    //YR_MEMORY_BLOCK*  mem_block;

+  //YR_MEMORY_BLOCK*  mem_block;

   YR_HASH_TABLE*  objects_table;

-    //YR_CALLBACK_FUNC  callback;

-

+  //YR_CALLBACK_FUNC  callback;

+  fmap_t * fmap;

 } YR_SCAN_CONTEXT;

 #endif

@@ -92,6 +92,19 @@ typedef struct _YR_MATCH

       } \

       return UNDEFINED; \

     };

+#else

+#define function_read(type) \

+    int64_t read_##type(fmap_t * fmap, size_t offset) \

+    { \

+      const void *data;                                         \

+      if (offset + sizeof(type) >= fmap->len)                   \

+          return UNDEFINED;                                     \

+      data = fmap_need_off_once(fmap, offset, sizeof(type));    \

+      if (!data)                                                \

+          return UNDEFINED;                                     \

+      return *((type *) data);                                  \

+    };

+#endif

 function_read(uint8_t)

 function_read(uint16_t)

@@ -99,7 +112,6 @@ function_read(uint32_t)

 function_read(int8_t)

 function_read(int16_t)

 function_read(int32_t)

-#endif

 int yr_execute_code(

 #if REAL_YARA

@@ -797,6 +809,36 @@ int yr_execute_code(

         pop(r1);

         push(read_uint32_t(context->mem_block, r1));

         break;

+#else

+      case OP_INT8:

+        pop(r1);

+        push(read_int8_t(context->fmap, r1));

+        break;

+

+      case OP_INT16:

+        pop(r1);

+        push(read_int16_t(context->fmap, r1));

+        break;

+

+      case OP_INT32:

+        pop(r1);

+        push(read_int32_t(context->fmap, r1));

+        break;

+

+      case OP_UINT8:

+        pop(r1);

+        push(read_uint8_t(context->fmap, r1));

+        break;

+

+      case OP_UINT16:

+        pop(r1);

+        push(read_uint16_t(context->fmap, r1));

+        break;

+

+      case OP_UINT32:

+        pop(r1);

+        push(read_uint32_t(context->fmap, r1));

+        break;

 #endif

       case OP_CONTAINS: