Skip to content
yararules.org
Menu

Glossary

wide

The wide modifier matches a YARA string encoded as UTF-16LE, where each ASCII character is followed by a zero byte.

Windows programs often store strings as UTF-16LE. $a = "Global\\Mutex" wide matches G\x00l\x00o\x00…. With wide alone the plain ASCII form is no longer searched; write ascii wide to match both.

wide covers only characters encodable as one byte followed by 00, not arbitrary Unicode. See string modifiers.