Skip to content

Add base to offset on string matches.#1

Merged
plusvic merged 1 commit intoVirusTotal:masterfrom
wxsBSD:add_base
Aug 3, 2016
Merged

Add base to offset on string matches.#1
plusvic merged 1 commit intoVirusTotal:masterfrom
wxsBSD:add_base

Conversation

@wxsBSD
Copy link
Contributor

@wxsBSD wxsBSD commented Sep 30, 2015

This addresses yara issue #349.

@jhumble
Copy link

jhumble commented Jan 18, 2016

Did this make it into 3.4? Thanks!

@wxsBSD
Copy link
Contributor Author

wxsBSD commented Jan 18, 2016

I don't think so.

@plusvic plusvic merged commit 051c5ff into VirusTotal:master Aug 3, 2016
@wxsBSD wxsBSD deleted the add_base branch November 9, 2017 19:47
plusvic pushed a commit that referenced this pull request May 20, 2022
The `Rules.match` function now receives an optional `allow_duplicate_metadata=True` argument, which changes the structure of `Match.meta`. By default `Match.meta` is a dictionary with metadata names and their corresponding values, if a metadata name appears duplicated in a rule, the last value will be used. For example, consider the following rule:

```yara
rule demo {
   meta: 
     foo = "foo #1"
     foo = "foo #2"
     bar = "bar"
   condition:
      false
}
```

In that case `Match.meta` would be `{"foo": "foo #2", "bar": "bar"}` by default (`allow_duplicate_metadata=False`), but with `allow_duplicate_metadata=True` it would be: `{"foo": ["foo #1", "foo #2"], "bar": ["bar"]}`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants