Yes. And you'd have to scape the dollar signs too. Or you could just use
single quotes around the whole thing:
echo 'rule a { strings: $h = "arnav" condition: $h }' > a
Att,
@MercesFernando
mentebinaria.com.br <http://www.mentebinaria.com.br>
---------------------------
On Sun, Mar 18, 2018 at 9:26 PM, Wesley Shields <[email protected]> wrote:
> The inner quotes are not escaped.
>
> — WXS
>
> On Sun, Mar 18, 2018 at 8:24 PM <[email protected]> wrote:
>
>> Hi
>>
>> I ran this rule while learning:
>> echo "rule a { strings: $h = "arnav" condition: $h } > a
>>
>> but when I run
>> yara a a
>>
>> it gives me this error:
>> error: syntax error, unexpected '=', expecting _STRING_IDENTIFIER_
>>
>> I can't figure out what's wrong.
>>
>> --
>> You received this message because you are subscribed to the Google Groups
>> "YARA" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to [email protected].
>> For more options, visit https://groups.google.com/d/optout.
>>
> --
> You received this message because you are subscribed to the Google Groups
> "YARA" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> For more options, visit https://groups.google.com/d/optout.
>
--
You received this message because you are subscribed to the Google Groups
"YARA" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
