Skip to content

Instantly share code, notes, and snippets.

@darkarnium

darkarnium/example.yar

Last active November 7, 2019 15:17
Show Gist options
  • Save darkarnium/3b35176c09dc79b239ae836c98986ce1 to your computer and use it in GitHub Desktop.
Save darkarnium/3b35176c09dc79b239ae836c98986ce1 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
example.yar
rule MyExample {
strings:
$a = /EXAMPLE[A-Z]{10}/ ascii wide nocase
$b = /EXAMPLE[A-Z]{5}KNOWN/ ascii wide nocase
condition:
for any i in (1..#a) : ( @a[i] != @b[i] )
// for any i in (1..#a) : ( @a[i] == @a[i] )
// any of them
}
Raw
sample
_______EXAMPLEAAAAAAAAAA____
_______EXAMPLEAAAAAAAAAB____
_______EXAMPLEAAAAAAAAAC____
_______EXAMPLEAAAAAKNOWN____
_______EXAMPLEABCDEFABCD____
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment