YARA-X 1.22.0 adds 64-bit integer readers to the rule language
Victoria Shinder1 min readYARA-X 1.22.0 is out, carrying 11 improvements and nine bug fixes, as noted by Didier Stevens at the SANS Internet Storm Center on 25 October. The change that stands out for rule authors is a set of built-in functions to read 64-bit integers directly: int64, int64be, uint64 and uint64be, covering signed and unsigned values in both byte orders. YARA-X is the Rust reimplementation of YARA, the pattern-matching engine used across malware triage and threat hunting.
What it means
The classic YARA integer functions topped out at 32 bits, which forced awkward workarounds whenever a rule needed to read a 64-bit field — file offsets, sizes and timestamps in modern formats routinely exceed what 32 bits hold, and PE, ELF and Mach-O all carry 64-bit structures. Reading them as two halves and stitching them back together is the kind of fiddly arithmetic that makes a rule hard to review and easy to get wrong, especially across endianness. Native int64 and uint64 readers, with explicit big-endian variants, let a rule address those fields the way the file format actually defines them. It is a small addition that removes a recurring source of silent bugs in detection logic.