========================
Simple internal variable
========================

rule test {
    variables:
        my_var = 1
    condition:
        my_var == 1
}

-----

(yara_file
    (rule 
        (rule_head
            (identifier)
        )
        (rule_body
            (internal_var_list
                (internal_var
                    (identifier)
                    (uint_literal
                        (dec_uint_literal_value)
                    )    
                )
            )
			(equal
				(identifier)
				(uint_literal
				    (dec_uint_literal_value)
				)    
			)    
        )    
    )    
)


===============================
Position of variable section #1
===============================

rule test {
	strings:
		$a = "a"
    variables:
        my_var = 1
    condition:
        my_var == 1
}

-----

(yara_file
    (rule 
        (rule_head
            (identifier)
        )
        (rule_body
			(strings_list
				(string
					(string_identifier)
					(string_literal
					    (string_literal_str)
					)
				)
			)
            (internal_var_list
                (internal_var
                    (identifier)
                    (uint_literal
                        (dec_uint_literal_value)
                    )    
                )
            )
			(equal
				(identifier)
				(uint_literal
				    (dec_uint_literal_value)
				)    
			)    
        )    
    )    
)


===============================
Position of variable section #2
===============================

rule test {
    variables:
        my_var = 1
	strings:
		$a = "a"
    condition:
        my_var == 1
}

-----

(yara_file
    (rule 
        (rule_head
            (identifier)
        )
        (rule_body
            (internal_var_list
                (internal_var
                    (identifier)
                    (uint_literal
                        (dec_uint_literal_value)
                    )    
                )
            )
			(strings_list
				(string
					(string_identifier)
					(string_literal
					    (string_literal_str)
					)
				)
			)
			(equal
				(identifier)
				(uint_literal
				    (dec_uint_literal_value)
				)    
			)
        )    
    )    
)


===================================================
Multiple internal variables with various data types
===================================================

rule test {
    variables:
        my_var_bool = true
        my_var_int = -12
        my_var_double = 4.2
        my_var_expression = 2 + 3
    condition:
        my_var_bool and my_var_int and my_var_double
        and my_var_expression
}

-----

(yara_file
    (rule 
        (rule_head
            (identifier)    
        )
        (rule_body
            (internal_var_list
                (internal_var
                    (identifier)
                    (bool_literal)    
                )
                (internal_var
                    (identifier)
                    (unary_minus
                        (uint_literal
                            (dec_uint_literal_value)
                        )    
                    )
                )
                (internal_var
                    (identifier)
                    (float_literal)    
                )
                (internal_var
                    (identifier)
                    (addition
                        (uint_literal
                            (dec_uint_literal_value)
                        )
                        (uint_literal
                            (dec_uint_literal_value)
                        )
                    )    
                )
            )
			(and
				(and
					(and
						(identifier)
						(identifier)
					)
					(identifier)
				)
				(identifier)
			)
        )
    )    
)


===================================
Typical usage of internal variables
===================================

rule test {
    variables:
        my_var1 = uint8(4)
        my_var2 = uint16(0) << 4
        my_var3 = uint8(8) | uint32(32)
    condition:
        my_var1 == 0x12 and my_var2 == 0x1234 or my_var3 == 0x12345678 
}

-----

(yara_file
    (rule 
        (rule_head
            (identifier)    
        )
        (rule_body
            (internal_var_list
                (internal_var
                    (identifier)
                    (function_call
                        (identifier)
                        (argument_list
                            (uint_literal
                                (dec_uint_literal_value)
                            )
                        )
                    )    
                )
                (internal_var
                    (identifier)
                    (left_shift
                        (function_call
                            (identifier)
                            (argument_list
                                (uint_literal
                                    (dec_uint_literal_value)
                                )
                            )
                        )
                        (uint_literal
                            (dec_uint_literal_value)
                        )
                    )
                )
                (internal_var
                    (identifier)
                    (bitwise_or
                        (function_call
                            (identifier)
                            (argument_list
                                (uint_literal
                                    (dec_uint_literal_value)
                                )
                            )
                        )  
                        (function_call
                            (identifier)
                            (argument_list
                                (uint_literal
                                    (dec_uint_literal_value)
                                )
                            )
                        )  
                    )    
                )
            )
			(or
                (and
                    (equal
                        (identifier)
                        (uint_literal
                            (hex_uint_literal_value)
                        )
                    )
                    (equal
                        (identifier)
                        (uint_literal
                            (hex_uint_literal_value)
                        )
                    )
                )
                (equal
                    (identifier)
                    (uint_literal
                        (hex_uint_literal_value)
                    )
                )
            )
        )
    )    
)
