plusvic/yara — pull request #215 by wxsBSD (2014-12-18 05:26:49+00:00)
Title: Resource name and entropy

Attributes of resources are now stored as an array of structs. In
particular these are the attributes:

type
id
language
size
data

There is also some attributes that are stored outside of the array,
because they are not specific to any given resource. These are:

resource_timestamp
resource_major_version
resource_minor_version
number_of_resources

I also had to update locale() and language() to work with this as there is no
longer a need to parse the resource table for these functions.

The point of doing this is that we can now do things like look for
resources with specific attributes. The data is stored in an attribute
so that you can use the hash module or the new entropy module on it too.

I've added an entropy module which will operate over a given
SIZED_STRING argument or over a range of bytes. It currently truncates
the result to an integer. I need to add support for double as a
first-class type in YARA.