-
Notifications
You must be signed in to change notification settings - Fork 42
Open
Description
I'm seeing a parser error when processing a rule that uses anonymous strings within the condition. I believe this is caused by the use of the anonymous identifier $
within the of
clause.
The following example raised a yaramod.ParserError
-> Reference to undefined string '$'
Example Rule:
rule example_rule
{
strings:
$ = "12345" nocase wide ascii
$ = "67890" nocase wide ascii
$ = {00 01 02 03 04 05}
condition:
any of ($)
}
If I modify the rule to use them
it is processed as expected.
Example:
rule example_rule
{
strings:
$ = "12345" nocase wide ascii
$ = "67890" nocase wide ascii
$ = {00 01 02 03 04 05}
condition:
any of them
}
Also using indexes for the strings, the rule is processed without error.
rule example_rule
{
strings:
$s1 = "12345" nocase wide ascii
$s2 = "67890" nocase wide ascii
$s3 = {00 01 02 03 04 05}
condition:
any of ($s*)
}