Skip to content

Commit ac40cbd

Browse files
malvidinmalvidin
committed
Add screenshot
1 parent c3c5948 commit ac40cbd

File tree

4 files changed

+65
-35
lines changed

4 files changed

+65
-35
lines changed

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Language support for the YARA pattern matching language
66
Check out the [project wiki](https://github.com/infosec-intern/vscode-yara/wiki) for more information
77

88
## Screenshot
9-
![Image as of 28 June 2021](images/28062021.PNG)
9+
![Image as of 2022 Aug 15](images/syntax_example_20220815.png)
1010

1111
## Features
1212
This extension provides many features common to code editors, such as

‎images/syntax_example_20220815.png

78.5 KB
Loading

‎yara/syntaxes/yara.tmLanguage.json

+59-30
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@
105105
"name": "support.other.meta-name.strings.yara",
106106
"match": "\\b([A-Z_a-z][0-9A-Z_a-z]{0,127})\\s*(=)\\s*(true|false)",
107107
"captures": {
108-
"1": {"name": "keyword.other.identifier.yara"},
108+
"1": {"name": "entity.other.meta.identifier.yara"},
109109
"2": {"name": "keyword.operator.assignment.yara"},
110110
"3": {"name": "constant.language.yara"}
111111
}
@@ -114,7 +114,7 @@
114114
"name": "support.other.meta-name.strings.yara",
115115
"match": "\\b([A-Z_a-z][0-9A-Z_a-z]{0,127})\\s*(=)\\s*([0-9]+)(KB|MB)?",
116116
"captures": {
117-
"1": {"name": "keyword.other.identifier.yara"},
117+
"1": {"name": "entity.other.meta.identifier.yara"},
118118
"2": {"name": "keyword.operator.assignment.yara"},
119119
"3": {"name": "constant.numeric.yara"},
120120
"4": {"name": "storage.type.number.postfix.yara"}
@@ -125,7 +125,7 @@
125125
"begin": "\\b([A-Z_a-z][0-9A-Z_a-z]{0,127})\\s*(=)\\s*(?=\")",
126126
"end": "(?<=\")",
127127
"beginCaptures": {
128-
"1": {"name": "keyword.other.identifier.yara"},
128+
"1": {"name": "entity.other.meta.identifier.yara"},
129129
"2": {"name": "keyword.operator.assignment.yara"}
130130
},
131131
"patterns": [
@@ -144,17 +144,19 @@
144144
{"include": "#comments"},
145145
{"include": "#string-assignment-text"},
146146
{"include": "#string-assignment-regex"},
147-
{"include": "#string-assignment-hex"}
147+
{"include": "#string-assignment-hex"},
148+
{"include": "#unmatched-characters"}
148149
]
149150
},
150151
"string-assignment-text": {
151152
"name": "support.other.attribute-name.strings.yara",
152-
"begin": "(\\$([0-9A-Z_a-z]+\\b)?)\\s*(=)(?=\\s*\")",
153+
"begin": "(\\$)([0-9A-Z_a-z]+\\b)?+\\s*+([^\\n\\s=][^=]*)?(=)(?=\\s*\")",
153154
"end": "(?=\\b(condition)\\b|\\$)",
154155
"beginCaptures": {
155-
"1": {"name": "keyword.other.string.identifier.name.yara"},
156-
"2": {"name": "keyword.other.string.identifier.yara"},
157-
"3": {"name": "keyword.operator.assignment.yara"}
156+
"1": {"name": "variable.language.string.identifier.yara"},
157+
"2": {"name": "variable.other.string.identifier.yara"},
158+
"3": {"name": "invalid.illegal.string.identifier.yara"},
159+
"4": {"name": "keyword.operator.assignment.yara"}
158160
},
159161
"patterns": [
160162
{"include": "#comments"},
@@ -165,12 +167,13 @@
165167
},
166168
"string-assignment-regex": {
167169
"name": "support.other.attribute-name.strings.yara",
168-
"begin": "(\\$([0-9A-Z_a-z]+)?)\\s*(=)(?=\\s*/)",
170+
"begin": "(\\$)([0-9A-Z_a-z]+\\b)?+\\s*+([^\\n\\s=][^=]*)?(=)(?=\\s*/)",
169171
"end": "(?=\\b(condition)\\b|\\$)",
170172
"beginCaptures": {
171-
"1": {"name": "keyword.other.string.identifier.yara"},
172-
"2": {"name": "keyword.other.string.identifier.name.yara"},
173-
"3": {"name": "keyword.operator.assignment.yara"}
173+
"1": {"name": "variable.language.string.identifier.yara"},
174+
"2": {"name": "variable.other.string.identifier.yara"},
175+
"3": {"name": "invalid.illegal.string.identifier.yara"},
176+
"4": {"name": "keyword.operator.assignment.yara"}
174177
},
175178
"patterns": [
176179
{"include": "#comments"},
@@ -185,12 +188,13 @@
185188
},
186189
"string-assignment-hex": {
187190
"name": "support.other.attribute-name.strings.yara",
188-
"begin": "(\\$([0-9A-Z_a-z]+\\b)?)\\s*(=)",
191+
"begin": "(\\$)([0-9A-Z_a-z]+\\b)?+\\s*+([^\\n\\s=][^=]*)?(=)",
189192
"end": "(?=\\b(condition)\\b|\\$)",
190193
"beginCaptures": {
191-
"1": {"name": "keyword.other.string.identifier.name.yara"},
192-
"2": {"name": "keyword.other.string.identifier.yara"},
193-
"3": {"name": "keyword.operator.assignment.yara"}
194+
"1": {"name": "variable.language.string.identifier.yara"},
195+
"2": {"name": "variable.other.string.identifier.yara"},
196+
"3": {"name": "invalid.illegal.string.identifier.yara"},
197+
"4": {"name": "keyword.operator.assignment.yara"}
194198
},
195199
"patterns": [
196200
{"include": "#comments"},
@@ -253,7 +257,7 @@
253257
},
254258
"hex-jump": {
255259
"name": "entity.name.jump.hex.yara",
256-
"begin": "\\[",
260+
"begin": "\\[\\s*(?=([1-9][0-9]*|[0-9]*\\s*-|[0-9]+\\s*-\\s*[0-9]*)\\s*\\])",
257261
"end": "\\]",
258262
"patterns": [
259263
{
@@ -279,7 +283,7 @@
279283
}
280284
},
281285
"base64-modifier": {
282-
"begin": "\\b(base64)\\s*(\\()",
286+
"begin": "\\b(base64)\\s*(\\()(?=\\s*\")",
283287
"end": "(\\))",
284288
"beginCaptures": {
285289
"1": {"name": "keyword.other.modifier.yara"},
@@ -300,7 +304,7 @@
300304
{"include": "#base64-modifier"},
301305
{
302306
"name": "keyword.other.modifier.yara",
303-
"match": "\\b(nocase|wide|ascii|xor|base64|base64wide|fullword|private)\\b"
307+
"match": "\\b(nocase|wide|ascii|xor|base64|base64wide|fullword|private)\\b(?!\\()"
304308
},
305309
{"include": "#comments"},
306310
{"include": "#unmatched-characters"}
@@ -341,8 +345,28 @@
341345
{"include": "#string-identifiers"},
342346
{"include": "#booleans"},
343347
{
344-
"name": "storage.type.keyword.yara",
345-
"match": "\\b(all|and|any|at|contains|endswith|entrypoint|filesize|for|icontains|iendswith|iequals|in|int16|int16be|int32|int32be|int8|int8be|istartswith|matches|none|not|of|or|startswith|them|uint16|uint16be|uint32|uint32be|uint8|uint8be|defined)\\b"
348+
"name": "constant.numeric.keyword.yara",
349+
"match": "\\b(all|any|none|filesize)\\b"
350+
},
351+
{
352+
"name": "constant.numeric.keyword.yara invalid.deprecated.keyword.yara",
353+
"match": "\\b(entrypoint)\\b"
354+
},
355+
{
356+
"name": "variable.language.string.identifier.wildcard.yara",
357+
"match": "\\b(them)\\b"
358+
},
359+
{
360+
"name": "keyword.other.yara",
361+
"match": "\\b(at|for|in|of)\\b"
362+
},
363+
{
364+
"name": "support.function.other.yara",
365+
"match": "\\b((?:u?int)(?:8|16|32)(?:be)?)(?=\\s*(\\(|\n))"
366+
},
367+
{
368+
"name": "variable.language.loop.variable.yara",
369+
"match": "([!@#$])(?![0-9A-Z_a-z])"
346370
},
347371
{"include": "#identifiers"},
348372
{"include": "#unmatched-characters"}
@@ -393,11 +417,11 @@
393417
},
394418
"relational-operators-text": {
395419
"name": "keyword.operator.comparison.yara",
396-
"match": "\\b(contains|icontains|startswith|istartswith|endswith|iendswith|iequals)\\b"
420+
"match": "\\b(contains|icontains|startswith|istartswith|endswith|iendswith|iequals)(?=\\s*\")"
397421
},
398422
"relational-operators-regexp": {
399423
"name": "keyword.operator.comparison.yara",
400-
"match": "\\b(matches)\\b"
424+
"match": "\\b(matches)(?=\\s*/)"
401425
},
402426
"rule-end": {
403427
"name": "punctuation.definition.rule.end.yara",
@@ -418,7 +442,12 @@
418442
},
419443
"string-identifiers": {
420444
"name": "variable.other.string_identifier.yara",
421-
"match": "[!@#$][0-9A-Z_a-z]*"
445+
"match": "([!@#$])([0-9A-Z_a-z]+|(?=[*]))([*]?)",
446+
"captures": {
447+
"1": {"name": "variable.language.string.identifier.yara"},
448+
"2": {"name": "variable.other.string.identifier.yara"},
449+
"3": {"name": "string.interpolated.string.identifier.yara"}
450+
}
422451
},
423452
"regexp-strings": {
424453
"name": "string.regexp.yara",
@@ -565,10 +594,11 @@
565594
]
566595
},
567596
"regexp-parentheses": {
568-
"begin": "\\(",
569-
"end": "(\\)|(?=\"))|((?=(?<!\\\\)\\n))",
597+
"begin": "(\\()([+*?])?",
598+
"end": "(\\)|(?=/))|((?=(?<!\\\\)\\n))",
570599
"beginCaptures": {
571-
"0": {"name": "punctuation.parenthesis.begin.regexp support.other.parenthesis.regexp"}
600+
"1": {"name": "punctuation.parenthesis.begin.regexp support.other.parenthesis.regexp"},
601+
"2": {"name": "invalid.illegal.group.construct.regexp"}
572602
},
573603
"endCaptures": {
574604
"1": {"name": "punctuation.parenthesis.end.regexp support.other.parenthesis.regexp"},
@@ -644,7 +674,7 @@
644674
"name":"constant.numeric.hex.yara",
645675
"match": "\\b(0x)[0-9A-Fa-f]+\\b",
646676
"captures": {
647-
"1": {"name": "storage.type.number.yara"}
677+
"1": {"name": "storage.modifier.number.yara"}
648678
}
649679
},
650680
{
@@ -708,7 +738,6 @@
708738
[ "/", "/" ],
709739
[ "(", ")" ],
710740
[ "{", "}" ],
711-
[ "[", "]" ],
712-
[ "/*", "*/" ]
741+
[ "[", "]" ]
713742
]
714743
}

‎yara/yara.configuration.json

+5-4
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,18 @@
1313
],
1414
// symbols that are auto closed when typing
1515
"autoClosingPairs": [
16-
["\"", "\""],
16+
{"open": "\"", "close": "\"", "notIn": ["string"]},
17+
{"open": "/", "close": "/", "notIn": ["string"]},
1718
["{", "}"],
1819
["[", "]"],
19-
["(", ")"],
20-
["/", "/"]
20+
["(", ")"]
2121
],
2222
// symbols that that can be used to surround a selection
2323
"surroundingPairs": [
2424
["{", "}"],
2525
["[", "]"],
2626
["(", ")"],
27-
["\"", "\""]
27+
["\"", "\""],
28+
["/", "/"]
2829
]
2930
}

0 commit comments

Comments
 (0)