Skip to content
yararules.org
Menu

Glossary

Hex string

A YARA hex string describes raw bytes in braces, with wildcards, nibble wildcards, jumps and alternatives for variable parts.

A hex string matches a byte sequence written in hexadecimal between braces: $h = { 4D 5A 90 00 }. Variable parts are expressed with wildcards (??, 4?), jumps ([2-6]), alternations (( 01 | 02 03 )) and the not operator (~00).

Hex strings are ideal for code sequences and binary structures. Keep at least four consecutive fixed bytes so YARA can pick a good atom.