Skip to content

Commit

Permalink
Implement "none" keyword (VirusTotal#1559)
Browse files Browse the repository at this point in the history
Co-authored-by: Victor M. Alvarez <[email protected]>
  • Loading branch information
wxsBSD and plusvic authored Sep 2, 2021
1 parent eadd856 commit eb92e6b
Show file tree
Hide file tree
Showing 7 changed files with 1,181 additions and 1,138 deletions.
15 changes: 8 additions & 7 deletions docs/writingrules.rst
Original file line number Diff line number Diff line change
Expand Up @@ -57,24 +57,24 @@ keywords are reserved and cannot be used as an identifier:
- matches
- meta
- nocase
* - not
* - none
- not
- of
- or
- private
- rule
- startswith
- strings
- them
* - true
* - them
- true
- uint16
- uint16be
- uint32
- uint32be
- uint8
- uint8be
- wide
* - xor
-
* - wide
- xor
-
-
-
Expand Down Expand Up @@ -1156,7 +1156,7 @@ the equivalent keyword ``them`` for more legibility.

In all the examples above, the number of strings have been specified by a
numeric constant, but any expression returning a numeric value can be used.
The keywords ``any`` and ``all`` can be used as well.
The keywords ``any``, ``all`` and ``none`` can be used as well.

.. code-block:: yara

Expand All @@ -1165,6 +1165,7 @@ The keywords ``any`` and ``all`` can be used as well.
all of ($a*) // all strings whose identifier starts by $a
any of ($a,$b,$c) // any of $a, $b or $c
1 of ($*) // same that "any of them"
none of ($b*) // zero of the set of strings that start with "$b"


Starting with YARA 4.2.0 it is possible to express a set of strings in an
Expand Down
Loading

0 comments on commit eb92e6b

Please sign in to comment.