Skip to content
yararules.org
Menu

Glossary

String modifier

String modifiers such as ascii, wide, nocase, fullword, xor, base64 and private change how a YARA pattern is searched and reported.

Modifiers follow a pattern declaration and adjust matching: ascii and wide choose encodings, nocase ignores case, fullword requires word boundaries, xor and base64 search encoded forms, and private hides the pattern from output.

Some combinations are invalid (for example xor with nocase); YARA-X reports them as errors. See the strings guide.