Skip to content
yararules.org
Menu

Glossary

Alternation (hex)

Alternation in a YARA hex string, written ( A | B ), matches one of several byte sequences, which may differ in length.

Alternatives inside a hex string are grouped in parentheses and separated by |: { 68 ( 00 10 | 00 20 ) 00 00 }. Each branch may contain wildcards and have a different length.

Alternation is useful for small families of byte variants, such as different register encodings of the same instruction. For many variants, consider several patterns combined with any of.