Skip to content
yararules.org
Menu

Glossary

Jump (hex)

A jump in a YARA hex string, written [n-m], matches a run of n to m arbitrary bytes between two fixed parts of a pattern.

Jumps let a hex string skip a variable number of bytes: [4] skips exactly four, [2-6] between two and six, [8-] eight or more. Example: { 55 8B EC [2-6] 83 EC 20 }.

Prefer bounded jumps: unbounded or very long jumps make matching more expensive. The length of an actual match is available in the condition as !a[i].