Hi, I am learning Yara and have a question about how to create a rule that matches multiple conditions in an offset range For example, I check two strings str1 and str2. Both str1 and str2 can appear multiple times in the file. My hit condition is that I see both strings and there exists a matching pair of str1 and str2 whose offset is less than 100 bytes. The order doesn't matter. Does Yara support this? if it supports, how the rule looks like?
Thanks! -- You received this message because you are subscribed to the Google Groups "YARA" group. To unsubscribe from this group and stop receiving emails from it, send an email to yara-project+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/yara-project/fd27b298-7ebe-41d7-abe8-9615da478181n%40googlegroups.com.
