data/syntax/yara.xml

0001 <?xml version="1.0" encoding="UTF-8"?>
0002 <!DOCTYPE language>
0003 <language name="YARA" section="Other" version="5" kateversion="5.53" indenter="cstyle" extensions="*.yar;*.yara" license="MIT">
0004   <highlighting>
0005     <list name="keywords">
0006       <item>all</item>
0007       <item>and</item>
0008       <item>any</item>
0009       <item>ascii</item>
0010       <item>at</item>
0011       <item>base64</item>
0012       <item>base64wide</item>
0013       <item>condition</item>
0014       <item>contains</item>
0015       <item>endswith</item>
0016       <item>entrypoint</item> <!-- being deprecated-->
0017       <item>filesize</item>
0018       <item>for</item>
0019       <item>fullword</item>
0020       <item>global</item>
0021       <item>icontains</item>
0022       <item>iendswith</item>
0023       <item>iequals</item>
0024       <item>import</item>
0025       <item>in</item>
0026       <item>include</item>
0027       <item>int8</item>
0028       <item>int16</item>
0029       <item>int32</item>
0030       <item>int8be</item>
0031       <item>int16be</item>
0032       <item>int32be</item>
0033       <item>istartswith</item>
0034       <item>matches</item>
0035       <item>meta</item>
0036       <item>nocase</item>
0037       <item>none</item>
0038       <item>not</item>
0039       <item>or</item>
0040       <item>of</item>
0041       <item>private</item>
0042       <item>rule</item>
0043       <item>startswith</item>
0044       <item>strings</item>
0045       <item>them</item>
0046       <item>uint8</item>
0047       <item>uint16</item>
0048       <item>uint32</item>
0049       <item>uint8be</item>
0050       <item>uint16be</item>
0051       <item>uint32be</item>
0052       <item>wide</item>
0053       <item>xor</item>
0054     </list>
0055
0056     <list name="boolean">
0057         <item>false</item>
0058         <item>true</item>
0059     </list>
0060
0061     <contexts>
0062       <context attribute="Normal Text" lineEndContext="#stay" name="Normal">
0063         <keyword attribute="Keyword" context="#stay" String="keywords"/>
0064         <keyword attribute="Boolean" String="boolean" context="#stay"/>
0065         <DetectChar attribute="String" context="String" char="&quot;"/>
0066         <!--<IncludeRules context="##Doxygen" />-->
0067         <Detect2Chars attribute="Comment" context="Comment" char="/" char1="/"/>
0068         <Detect2Chars attribute="Comment" context="Multiline Comment" char="/" char1="*" beginRegion="Comment"/>
0069         <RegExpr attribute="Identifier" context="#pop" String="\$\w*" />
0070         <RegExpr attribute="Rule" context="#stay" String="(?&lt;=rule\s)\s*[_a-zA-Z]\w{0,127}" />
0071         <RegExpr attribute="Hex String" context="#stay" String="(?&lt;=[\]{\(|\)])[\s]*?(?:[\dA-Fa-f?]{2}[\s]*?)+(?=[\(|\)}\[])" />
0072         <!-- Regular Expressions, obtained from javascript.xml -->
0073         <RegExpr attribute="Start Regular Expression" context="(regex caret first check)##JavaScript" String="/(?=(?:[^/\\\[]|\\.|\[(?:[^\]\\]|\\.)+\])+/(?:[gimsuy]+(?!\s*[\w$])|(?![/\*])|(?=/\*)))" />
0074         <DetectChar attribute="Symbol" context="#stay" char="{" beginRegion="block1"/>
0075         <DetectChar attribute="Symbol" context="#stay" char="}" endRegion="block1"/>
0076         <Float attribute="Float" context="#stay"/>
0077         <HlCHex attribute="Hex" context="#stay"/>
0078         <Int attribute="Decimal" context="#stay"/>
0079       </context>
0080
0081       <context attribute="String" lineEndContext="#pop" name="String">
0082         <LineContinue attribute="String" context="#pop"/>
0083         <HlCStringChar attribute="String Char" context="#stay"/>
0084         <DetectChar attribute="String" context="#pop" char="&quot;"/>
0085       </context>
0086
0087       <context attribute="Comment" lineEndContext="#pop" name="Comment">
0088         <DetectSpaces />
0089         <IncludeRules context="##Comments"/>
0090       </context>
0091       <context attribute="Comment" lineEndContext="#stay" name="Multiline Comment">
0092         <DetectSpaces />
0093         <Detect2Chars attribute="Comment" context="#pop" char="*" char1="/" endRegion="Comment"/>
0094         <IncludeRules context="##Comments"/>
0095       </context>
0096     </contexts>
0097
0098     <itemDatas>
0099       <itemData name="Normal Text"  defStyleNum="dsNormal" spellChecking="false"/>
0100       <itemData name="Keyword"      defStyleNum="dsKeyword" spellChecking="false"/>
0101       <itemData name="Rule"         defStyleNum="dsFunction" spellChecking="false"/>
0102       <itemData name="Boolean"      defStyleNum="dsConstant" spellChecking="false"/>
0103       <itemData name="Identifier"   defStyleNum="dsVariable" spellChecking="false"/>
0104       <itemData name="Decimal"      defStyleNum="dsDecVal" spellChecking="false"/>
0105       <itemData name="Hex"          defStyleNum="dsBaseN" spellChecking="false"/>
0106       <itemData name="Hex String"   defStyleNum="dsSpecialString" spellChecking="false"/>
0107       <itemData name="Float"        defStyleNum="dsFloat" spellChecking="false"/>
0108       <itemData name="String"       defStyleNum="dsString"/>
0109       <itemData name="String Char"  defStyleNum="dsSpecialChar" spellChecking="false"/>
0110       <itemData name="Comment"      defStyleNum="dsComment"/>
0111       <itemData name="Symbol"       defStyleNum="dsNormal"/>
0112       <itemData name="Start Regular Expression" defStyleNum="dsSpecialString" spellChecking="false" />
0113     </itemDatas>
0114   </highlighting>
0115
0116   <general>
0117     <comments>
0118       <comment name="singleLine" start="//" position="afterwhitespace" />
0119       <comment name="multiLine" start="/*" end="*/" region="Comment" />
0120     </comments>
0121   </general>
0122
0123 </language>
0124 <!-- kate: replace-tabs on; tab-width 2; indent-width 2; -->