Add ability to use a dictionary when specifying Externals in yara-python
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 30/100
Research direction
Begin at the yara.compile entry point and trace how the externals mapping is validated and passed to YARA. Determine the behavior needed for list and dictionary values, including the supplied rule examples and missing dictionary keys; done means these cases have defined, tested behavior.
Written by the indexing model from the issue text.
Description
Hello,
TLDR; Would it be possible to add Lists & Dictionaries as allowed types for Yara-python externals?
--
I've recently been looking at various ways to use the rich pattern matching and conditions from YARA to non-file use cases (e.g. where you just have metadata about a file, or an event, or anything really).
One thing that would be useful in my work is that sometimes I'm taking output from a tool which is by default a dictionary.
Since other native modules to YARA (such as PE) appear to effectively have dictionary structures available, would it be possible to allow use of dictionaries/lists in externals?
Then I could have say:
custom_externals = {"Events" : []}
yara.compile(source="some_rules.dat", externals=custom_externals)
Where each entry in Events is a dictionary, and then rules that look like this:
for any event in Events:
event.event_id == 1 and
Or a simpler case:
custom_externals = {"EventData" : {
"defined_key": ""
}
}
And then rules like:
EventData.defined_key matches /foo/i or
EventData.undefined_key matches /bar/i
--
Im not sure how plausible these suggestions are, or if they would be easier to implement in yara 4?
Cheers,
Tom
- Dominant language
- C
- Stars
- 754
- Forks
- 190
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from VirusTotal/yara-python
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
VirusTotal/yara-python#263 · 2 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 28/100
VirusTotal/yara-python#234 · 2 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
VirusTotal/yara-python#218 · 3 reactions ·
-
Difficulty 4/5 3-5 days Newbie friendliness 20/100
VirusTotal/yara-python#216 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
VirusTotal/yara-python#212 · 11 comments ·
All issues in VirusTotal/yara-python
Similar issues
-
level/task module/gcp type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
Difficulty 1/5 Under an hour Newbie friendliness 86/100
hapostgres/pg_auto_failover#1190 ·
-
docs
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
P3 sonic-vpp
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
sonic-net/sonic-buildimage#29662 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 94/100
spack/spack-packages#6586 ·