YARA _01

rule R1
{
    strings:
        $a = "Kim Jun Hyeon"
        $b = "Hello World"
        $c = "Nobreak"
    condition:
        2 of ($a, $b, $c)
}

# $a, $b, $c 가운데 2개가 만족할 때 

=====================================

# python 코드

import yara as y

import pprint as ppr

t = y.compile("YARA_RUL_01")

s = t.match("t")

ppr.pprint (s)

=====================================

# 결과

{'main': [{'matches': True,

           'meta': {},

           'rule': 'R1',

           'strings': [{'data': 'Hello World',

                        'flags': 19,

                        'identifier': '$b',

                        'offset': 15},

                       {'data': 'Kim Jun Hyeon',

                        'flags': 19,

                        'identifier': '$a',

                        'offset': 0}],

           'tags': []}]}