=================
Set of strings #1
=================

rule filesize_test {
    strings:
        $a = "a"
        $b = "b"
        $c = "c"
    condition:
        2 of ($a, $b, $c)
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (strings_list
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
            )
            (of
                (uint_literal
                    (dec_uint_literal_value)
                )
                (string_set
                    (string_identifier)
                    (string_identifier)
                    (string_identifier)
                )
            )
        )
    )
)


=================
Set of strings #2
=================

rule filesize_test {
    strings:
        $a = "a"
    condition:
        1 of ($a)
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (strings_list
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
            )
            (of
                (uint_literal
                    (dec_uint_literal_value)
                )
                (string_set
                    (string_identifier)
                )
            )
        )
    )
)


===================================
Set of strings #3 (string_wildcard)
===================================

rule filesize_test {
    strings:
        $str1 = "1"
        $str2 = "2"
        $strA = "A"
    condition:
        3 of ($str*)
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (strings_list
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
            )
            (of
                (uint_literal
                    (dec_uint_literal_value)
                )
                (string_set
                    (string_wildcard
                        (string_identifier)
                    )
                )
            )
        )
    )
)


========================
Set of strings #4 (them)
========================

rule filesize_test {
    strings:
        $str1 = "1"
        $str2 = "2"
        $strA = "A"
    condition:
        3 of them
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (strings_list
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
            )
            (of
                (uint_literal
                    (dec_uint_literal_value)
                )
                (them)
            )
        )
    )
)


=======================
Set of strings #5 (any)
=======================

rule filesize_test {
    strings:
        $str1 = "123"
        $str2 = "2345"
        $strA = "Abc"
    condition:
        any of ($str1, $str2, $strA)
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (strings_list
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
            )
            (of
                (any)
                (string_set
                    (string_identifier)
                    (string_identifier)
                    (string_identifier)
                )
            )
        )
    )
)


=======================
Set of strings #6 (all)
=======================

rule filesize_test {
    strings:
        $str1 = "123"
        $str2 = "2345"
    condition:
        all of ($str1, $str2)
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (strings_list
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
            )
            (of
                (all)
                (string_set
                    (string_identifier)
                    (string_identifier)
                )
            )
        )
    )
)


========================
Set of strings #7 (none)
========================

rule filesize_test {
    strings:
        $str1 = "123"
        $str2 = "2345"
    condition:
        none of ($str1, $str2)
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (strings_list
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
            )
            (of
                (none)
                (string_set
                    (string_identifier)
                    (string_identifier)
                )
            )
        )
    )
)


==============================
Set of strings #8 (..of..in..)
==============================

rule filesize_test {
    strings:
        $str1 = "123"
        $str2 = "2345"
    condition:
        any of ($str*) in (1..1+1)
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (strings_list
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
            )
            (of
                (any)
                (string_set
                    (string_wildcard
                        (string_identifier)
                    )
                )
                (range
                    (uint_literal
                        (dec_uint_literal_value)
                    )
                    (addition
                        (uint_literal
                            (dec_uint_literal_value)
                        )
                        (uint_literal
                            (dec_uint_literal_value)
                        )
                    )
                )
            )
        )
    )
)


======================================
Set of strings #9 (percent quantifier)
======================================

rule filesize_test {
    strings:
        $str1 = "123"
        $str2 = "2345"
    condition:
        50 % of ($str1, $str2)
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (strings_list
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
                (string
                    (string_identifier)
                    (string_literal
                        (string_literal_str)
                    )
                )
            )
            (of
                (percent_quantifier
                    (uint_literal
                        (dec_uint_literal_value)
                    )
                )
                (string_set
                    (string_identifier)
                    (string_identifier)
                )
            )
        )
    )
)

