Giters

OALabs / findyara-ida

IDA python plugin to scan binary with Yara rules

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Feature Request: Byte string highlight

juanandresgs opened this issue · comments

commented

This is really useful! Thank you for the plugin.

Any chance you'd consider highlighting disassembly lines in IDA-View that correspond to byte-string matches from the yara rule?

commented

If you have a proposal for how to do this I can look into it, but the issue is that the disassembly view does not match exactly with the raw bytes. For example if the match stops mid instruction we would be highlighting incorrect data. A workaround might be to just change Options->General->Number of opcode bytes to show the bytes beside each instruction and use this as a visual reference? Suggestions welcome : )