Skip to content
yararules.org
Menu

Glossary

Wildcard (hex)

In a YARA hex string, ?? matches any byte and a single ? matches one nibble, letting a pattern ignore bytes that vary.

Inside a hex string, ?? matches any byte and ? replaces one half of a byte: 4? matches 40 to 4F, ?A matches 0A, 1A … FA. Wildcards are typically used for addresses and immediates in code patterns, which change between builds.

Too many wildcards leave YARA without a good atom; keep a run of fixed bytes in every pattern.