You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
To implement #38, we'll need to add the information about match context to the database. AFAIK it's not possible to get it directly from Yara-Python (but do check), so it must be worked around by using offset: VirusTotal/yara#1335
This information should be stored for every string in every matched rule (there may be more than one rule). So maybe matches array should be changed to a dict. We can just store hexencoded context in the matches field then (as long as it's not too big).
for example if the rule is
rule test_romanum {
strings:
$a = "a"
$b = "b"
condition:
all of them
}
rule test_romanum {
strings:
$c = "c"
$d = "d"
condition:
all of them
}
There may be as much as 4 matches. If there are more than one match per string then only the first should be stored, and the rest ignored.
Finally, this information should be exposed via the API (included in the serialized object) like /api/job/{job_id}.
The text was updated successfully, but these errors were encountered:
To implement #38, we'll need to add the information about match context to the database. AFAIK it's not possible to get it directly from Yara-Python (but do check), so it must be worked around by using offset: VirusTotal/yara#1335
This information should be stored for every string in every matched rule (there may be more than one rule). So maybe
matches
array should be changed to a dict. We can just store hexencoded context in thematches
field then (as long as it's not too big).for example if the rule is
There may be as much as 4 matches. If there are more than one match per string then only the first should be stored, and the rest ignored.
Finally, this information should be exposed via the API (included in the serialized object) like
/api/job/{job_id}
.The text was updated successfully, but these errors were encountered: