Files
ImHex-Patterns/yara/advanced_analysis/language.yar
Mrmaxmeier c533017d0b git: Various style fixes everywhere, removing whitespaces (#321)
* repo-wide: trim trailing spaces

Note: This doesn't touch the .tbl files in encodings/ since they include
meaningful trailing spaces (`20= `)

* patterns: clean up duplicate semicolons

* ELF: add header magic check

* glTF: use type::Magic for magic value

* glTF: check that the file size in the header matches

* xgstexture: fix generics syntax for magic value

* JPEG: define hex enum with 0x00 instead of 0X00

* CI: update deprecated actions

---------

Co-authored-by: Nik <werwolv98@gmail.com>
2024-11-24 11:41:26 +01:00

61 lines
1.4 KiB
Plaintext

rule LanguageCpp {
meta:
category = "Programming Language"
name = "C++"
strings:
$exception_windows = "_CxxThrowException" ascii fullword
$iostreams = "iostream" ascii
condition:
any of them
}
rule LanguageC {
meta:
category = "Programming Language"
name = "C++"
strings:
$printf = "printf" ascii
$scanf = "scanf" ascii
$malloc = "malloc" ascii
$calloc = "calloc" ascii
$realloc = "realloc" ascii
$free = "free" ascii
condition:
any of them and not LanguageCpp
}
rule LanguageRust {
meta:
category = "Programming Language"
name = "Rust"
strings:
$option_unwrap = "called `Option::unwrap()` on a `None`" ascii
$result_unwrap = "called `Result::unwrap()` on an `Err`" ascii
$panic_1 = "panicked at" ascii
$panic_2 = "thread '' panicked at" ascii
$panic_3 = "thread panicked while processing panic. aborting." ascii
$panicking_file = "panicking.rs" ascii fullword
condition:
any of them
}
rule LanguageGo {
meta:
category = "Programming Language"
name = "Go"
strings:
$max_procs = "runtime.GOMAXPROCS" ascii fullword
$panic = "runtime.gopanic" ascii fullword
$go_root = "runtime.GOROOT" ascii fullword
condition:
any of them
}