Skip to content

Parser Error with Anonymous Strings #237

@idiom

Description

@idiom

I'm seeing a parser error when processing a rule that uses anonymous strings within the condition. I believe this is caused by the use of the anonymous identifier $ within the of clause.

The following example raised a yaramod.ParserError -> Reference to undefined string '$'

Example Rule:

rule example_rule
{
	strings:
        $ = "12345" nocase wide ascii
        $ = "67890" nocase wide ascii                
        $ = {00 01 02 03 04 05}
	condition:
		any of ($)
}

If I modify the rule to use them it is processed as expected.

Example:

rule example_rule
{
	strings:
        $ = "12345" nocase wide ascii
        $ = "67890" nocase wide ascii                
        $ = {00 01 02 03 04 05}
	condition:
		any of them
}

Also using indexes for the strings, the rule is processed without error.

rule example_rule
{
	strings:
        $s1 = "12345" nocase wide ascii
        $s2 = "67890" nocase wide ascii                
        $s3 = {00 01 02 03 04 05}
	condition:
		any of ($s*)
}

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions