=================
Single hex string
=================

rule my_rule {
    strings:
        $str = { AA BB 99 00 }
    condition:
        true
}

---

(yara_file
    (rule
        head: (rule_head
            id: (identifier)
        )
        body: (rule_body
            strings: (strings_list
                (string
                    id: (string_identifier)
                    value: (hex_str
                        (hex_str_sequence)
                    )
                )
            )
            
            condition: (bool_literal)
        )
    )
)


===============================
Single hex_string without spaces
===============================

rule my_rule {
    strings:
        $str = { AABBDD??00FFFF }
    condition:
        true
}

---

(yara_file
    (rule
        head: (rule_head
            id: (identifier)
        )
        body: (rule_body
            strings: (strings_list
                (string
                    id: (string_identifier)
                    value: (hex_str
                        (hex_str_sequence)
                    )
                )
            )
            
            condition: (bool_literal)
        )
    )
)


======================
Hex string not byte #1
======================

rule my_rule {
    strings:
        $str = { BB ~AA CC }
    condition:
        $str
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (strings_list
                (string
                    (string_identifier)
                    (hex_str
                        (hex_str_sequence
                            (hex_str_not)
                        )
                    )
                )
            )

            (string_identifier)
        )
    )
)


======================
Hex string not byte #2
======================

rule my_rule {
    strings:
        $str = { ~0? ~1A (~?C) }
    condition:
        $str
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (strings_list
                (string
                    (string_identifier)
                    (hex_str
                        (hex_str_sequence
                            (hex_str_not)
                            (hex_str_not)
                            (hex_str_parentheses
                                (hex_str_sequence
                                    (hex_str_not)
                                )
                            )
                        )
                    )
                )
            )

            (string_identifier)
        )
    )
)


=============================================
Single hex_string without spaces but with alt
=============================================

rule my_rule {
    strings:
        $str = { (393837393837|313233313233
        
        ) }
    condition:
        $str
}

---

(yara_file
    (rule
        head: (rule_head
            id: (identifier)
        )
        body: (rule_body
            strings: (strings_list
                (string
                    id: (string_identifier)
                    value: (hex_str
                        (hex_str_sequence
                            (hex_str_parentheses
                                (hex_str_alt
                                    lop: (hex_str_sequence)
                                    rop: (hex_str_sequence)
                                )
                            )
                        )
                    )
                )
            )
            
            condition: (string_identifier)
        )
    )
)


==================
Private hex string
==================

rule my_rule {
    strings:
        $str = { AA BB 99 00 } private
    condition:
        true
}

---

(yara_file
    (rule
        head: (rule_head
            id: (identifier)
        )
        body: (rule_body
            strings: (strings_list
                (string
                    id: (string_identifier)
                    value: (hex_str
                        (hex_str_sequence)
                    )
                    mods: (str_mod_list
                        (str_mod)
                    )
                )
            )
            
            condition: (bool_literal)
        )
    )
)

=============================
Single hex string w wildcards
=============================

rule my_rule {
    strings:
        $str = { A? BB 99 ?? BB }
    condition:
        true
}

---

(yara_file
    (rule
        head: (rule_head
            id: (identifier)
        )
        body: (rule_body
            strings: (strings_list
                (string
                    id: (string_identifier)
                    value: (hex_str
                        (hex_str_sequence)
                    )
                )
            )
            
            condition: (bool_literal)
        )
    )
)


===============================
Single hex string w parentheses
===============================

rule my_rule {
    strings:
        $str = { A? (BB (99 ??)) BB }
    condition:
        true
}

---

(yara_file
    (rule
        head: (rule_head
            id: (identifier)
        )
        body: (rule_body
            strings: (strings_list
                (string
                    id: (string_identifier)
                    value: (hex_str
                        (hex_str_sequence
                            (hex_str_parentheses
                                (hex_str_sequence
                                    (hex_str_parentheses
                                        (hex_str_sequence)
                                    )
                                )
                            )
                        )
                    )
                )
            )
            
            condition: (bool_literal)
        )
    )
)


=========================
Single hex string w or #1
=========================

rule my_rule {
    strings:
        $str = { A? (BB | (99 ??)) BB }
    condition:
        true
}

---

(yara_file
    (rule
        head: (rule_head
            id: (identifier)
        )
        body: (rule_body
            strings: (strings_list
                (string
                    id: (string_identifier)
                    value: (hex_str
                        (hex_str_sequence
                            (hex_str_parentheses
                                (hex_str_alt
                                    lop: (hex_str_sequence)
                                    rop: (hex_str_sequence
                                        (hex_str_parentheses
                                            (hex_str_sequence)
                                        )
                                    )
                                )
                            )
                        )
                    )
                )
            )
            
            condition: (bool_literal)
        )
    )
)



=========================
Single hex string w or #2
=========================

rule my_rule {
    strings:
        $str = { (00 | 12 | 13 | 45 | 78) }
    condition:
        true
}

---

(yara_file
    (rule
        head: (rule_head
            id: (identifier)
        )
        body: (rule_body
            strings: (strings_list
                (string
                    id: (string_identifier)
                    value: (hex_str
                        (hex_str_sequence
                            (hex_str_parentheses
                                (hex_str_alt
                                    lop: (hex_str_alt
                                        lop: (hex_str_alt
                                            lop: (hex_str_alt
                                                lop: (hex_str_sequence)
                                                rop: (hex_str_sequence)
                                            )
                                            rop: (hex_str_sequence)
                                        )
                                        rop: (hex_str_sequence)
                                    )
                                    rop: (hex_str_sequence)
                                )
                            )
                        )
                    )
                )
            )
            
            condition: (bool_literal)
        )
    )
)



============================
Single hex string w jumps #1
============================

rule my_rule {
    strings:
        $str = { AA [1-2] BB [1-] CC [-4] DD [10] EE }
    condition:
        true
}

---

(yara_file
    (rule
        head: (rule_head
            id: (identifier)
        )
        body: (rule_body
            strings: (strings_list
                (string
                    id: (string_identifier)
                    value: (hex_str
                        (hex_str_sequence
                            (hex_str_jump
                                lower: (hex_str_jump_number)
                                upper: (hex_str_jump_number)
                            )
                            (hex_str_jump
                                lower: (hex_str_jump_number)
                            )
                            (hex_str_jump
                                upper: (hex_str_jump_number)
                            )
                            (hex_str_jump
                                count: (hex_str_jump_number)
                            )
                        )
                    )
                )
            )
            
            condition: (bool_literal)
        )
    )
)


============================
Single hex string w jumps #2
============================

rule my_rule {
    strings:
        $str = { AA [1-2] [2] EE }
    condition:
        true
}

---

(yara_file
    (rule
        head: (rule_head
            id: (identifier)
        )
        body: (rule_body
            strings: (strings_list
                (string
                    id: (string_identifier)
                    value: (hex_str
                        (hex_str_sequence
                            (hex_str_jump
                                lower: (hex_str_jump_number)
                                upper: (hex_str_jump_number)
                            )
                            (hex_str_jump
                                count: (hex_str_jump_number)
                            )
                        )   
                    )
                )
            )
            
            condition: (bool_literal)
        )
    )
)


=========================================
Single hex string w jumps and parentheses
=========================================

rule my_rule {
    strings:
        $str = { AA (FF [1-] AA) EE }
    condition:
        true
}

---

(yara_file
    (rule
        head: (rule_head
            id: (identifier)
        )
        body: (rule_body
            strings: (strings_list
                (string
                    id: (string_identifier)
                    value: (hex_str
                        (hex_str_sequence
                            (hex_str_parentheses
                                (hex_str_sequence
                                    (hex_str_jump
                                        lower: (hex_str_jump_number)
                                    )
                                )
                            )
                        )
                    )
                )
            )
            
            condition: (bool_literal)
        )
    )
)


===================
Hex string error #1
===================

rule my_rule {
    strings:
        $str = { AA [1-2] [2] }
    condition:
        true
}

---

(yara_file
    (rule
        head: (rule_head
            id: (identifier)
        )
        body: (rule_body
            strings: (strings_list
                (string
                    id: (string_identifier)
                    value: (hex_str
                        (hex_str_sequence
                            (hex_str_jump
                                lower: (hex_str_jump_number)
                                upper: (hex_str_jump_number)
                            )
                            (hex_str_jump
                                count: (hex_str_jump_number)
                            )
                            (MISSING _hex_str_byte)
                        )
                    )
                )
            )
            
            condition: (bool_literal)
        )
    )
)


===================
Hex string error #2
===================

rule my_rule {
    strings:
        $str = { AA ([1-2] [2] BB) DD }
    condition:
        true
}

---

(yara_file
    (rule
        head: (rule_head
            id: (identifier)
        )
        body: (rule_body
            strings: (strings_list
                (string
                    id: (string_identifier)
                    value: (hex_str
                        (hex_str_sequence
                            (ERROR)
                            (hex_str_jump
                                lower: (hex_str_jump_number)
                                upper: (hex_str_jump_number)
                            )
                            (hex_str_jump
                                count: (hex_str_jump_number)
                            )
                        )
                        (ERROR
                            (identifier)
                        )
                    )
                )
            )
            
            condition: (bool_literal)
        )
    )
)


===================
Hex string error #3
===================

rule my_rule {
    strings:
        $str = { A AAA }
    condition:
        true
}

---

(yara_file
    (rule
        head: (rule_head
            id: (identifier)
        )
        body: (rule_body
            (ERROR
                (string_identifier)
                (identifier)
                (identifier)
            )
            
            condition: (bool_literal)
        )
    )
)


=========
Missing }
=========

rule my_rule {
    strings:
        $str = { 1A 2B 3C
    condition:
        true
}

---

(yara_file
    (rule
        head: (rule_head
            id: (identifier)
        )
        body: (rule_body
            strings: (strings_list
                (string
                    id: (string_identifier)
                    value: (hex_str
                        (hex_str_sequence)
                        (MISSING "}")
                    )
                )
            )
            
            condition: (bool_literal)
        )
    )
)



=========
Missing )
=========

rule my_rule {
    strings:
        $str = { (1A 2B 3C }
    condition:
        true
}

---

(yara_file
    (rule
        head: (rule_head
            id: (identifier)
        )
        body: (rule_body
            strings: (strings_list
                (string
                    id: (string_identifier)
                    value: (hex_str
                        (hex_str_sequence
                            (hex_str_parentheses
                                (hex_str_sequence)
                                (MISSING ")")
                            )
                        )
                    )
                )
            )
            
            condition: (bool_literal)
        )
    )
)
