Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add option to add comments to strings via rule builder #133

Open
2 tasks
TadeasKucera opened this issue Sep 4, 2020 · 1 comment
Open
2 tasks

Add option to add comments to strings via rule builder #133

TadeasKucera opened this issue Sep 4, 2020 · 1 comment

Comments

@TadeasKucera
Copy link
Contributor

TadeasKucera commented Sep 4, 2020

We would like the withPlainString, withHexString and withRegexp accept one more parameter comment and add supplied text as a one line comment next to the string. Through Python the functions may be accessed as follows:

a = YaraRuleBuilder()
a = a.with_name("b")
a = a.with_plain_string("$s1", "hello", "COMMENT")
a = a.with_condition(of(all(), them()).get())

which would create a rule

rule b
{
  strings:
    $s1 = "hello" // COMMENT
  condition:
    all of them
}
  • The new parameter comment needs to be optional.
  • The comment shall be after string modifiers if present.
@jconnor0426
Copy link

Bumping this feature request. This would really help us when using Yaramod to explain why strings were added to rules

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants