avast/yaramod

String location coordinates should start at the `$` symbol

MatejKastak opened this issue · 0 comments

String location does not point to the character $ and instead points to the first character of the identifier name.

  • string.location.begin [should be equal] string.token_id.location.begin
  • location.begin should point to the $ character
  • location.end should point to the last character of the string value (depending on the string type)
  • correctness can be checked with the following test:
    def test_string_id_location(self):
        ymod = yaramod.Yaramod()
        yara_file = ymod.parse_string(r'''rule rule1 : Tag1 {
    strings:
        $1 = "Hello World!"
    condition:
        false
}
''')
        s = yara_file.rules[0].strings[0]
        self.assertEqual(s.token_id.location.begin.line, 3)
        self.assertEqual(s.token_id.location.begin.column, 9)
        self.assertEqual(s.token_id.location.end.line, 3)
        self.assertEqual(s.token_id.location.end.column, 10)
        self.assertEqual(s.location.begin.line, 3)
        self.assertEqual(s.location.begin.column, 9)  # FIXME: Wrong - 10 / Correct - 9
        self.assertEqual(s.location.end.line, 3)
        self.assertEqual(s.location.end.column, 10)