Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[feature request] xorwide #1925

Open
tlansec opened this issue Jun 6, 2023 · 0 comments
Open

[feature request] xorwide #1925

tlansec opened this issue Jun 6, 2023 · 0 comments

Comments

@tlansec
Copy link
Contributor

tlansec commented Jun 6, 2023

Is your feature request related to a problem? Please describe.
At the moment we have the xor modifier, which can interact with the wide modifier in a way where the xor modifier is applied last. There isn't currently a method to define a string where the wide modifier is applied first, and then the xor modifier is applied.

Describe the solution you'd like
There should be a xorwide modifier which performs the xor operation and then the wide operation so that you can have a rule like this:

rule myrule
{
strings:
    $s = "http" xorwide(1-255)
condition:
    $s
}

Which matches a file with contents:

{00 6c 00 70 00 70 00 74 00} -> (http xor'ed with 0x04)

Describe alternatives you've considered
I could write a rule with 255 strings instead.

Additional context
N/A

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant