Function declaration split up in condition parsing ?

[wesinator]

https://github.com/plyara/plyara/blob/eb6cbff2f0b603e6fa0d7d721bf425833ba772cf/tests/data/import_ruleset_math.yar

The uint16(0) is split up in the condition parsing:

"condition_terms": [
            "uint16",
            "(",
            "0",
            ")",
            "==",
            "0x5a4d",

should it be

"condition_terms": [
            "uint16(0)",
            "==",
            "0x5a4d",

since uint16(0) is a single atomic statement ?

[utkonos]

Good idea. I'll need to think through how to do this best.

[utkonos]

Full granular condition parsing is a feature of 3.0.0. Take a look at the data model and the singledispatch to_yara() function. It already implements a few conditions granularly. The JSON output will have a nested recursive structure and will satisfy this enhancement request.

The new version is being built here:
https://github.com/plyara/plyara/tree/prep-3.0

Comments and feedback are welcome.