A simple YARA rule to check every other byte has zero as upper nibble

every_odd_byte_zero_upper_nibble.yar

/* Posted in answer to the question:
 *
 * "As a Yara rule, what's the right way to specify that every byte 
 * at an odd address must have a zero as its upper nybble?
 * 
 * Should I use an iterator for this, or is there a better way?"
 *
 * Asked by @travisgoodspeed on Twitter / X: 
 *  https://x.com/travisgoodspeed/status/1795911866411008003
 *
 * Iterator based example by @edeca.
 *
 * Performance optimisation using uint32(..) & 0xF0F0F0F0 left to the reader :)
 */ 

rule every_odd_byte_zero_upper_nibble {
  condition:
    for all i in (0..filesize-1) : (i & 0x1 == 0 or uint8(i) & 0xF0 == 0)
}